1f037b81239b4c7318991b15a4eb02be36800a43f11b2f35f68d1e0cf19e6023

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Size 9.0MB
Sample260930-e7xt3asxbx
SHA256 1f037b81239b4c7318991b15a4eb02be36800a43f11b2f35f68d1e0cf19e6023
MD5 1fb2e2efd2f997ca3082e18eff30fe74
SHA1 d01800734892f054980bbbd9502759d5e518eafe
SHA512 24bf0de9e58346149ae11770ad97e428561b6aa60f96deb8876ee14e1a9cd3965fcb6f70330538ac075e345c0bc9524335defc63e43264fad8d22e9361beafb8
SSDEEP 98304:ExY/1vFNfURgr1bpwvhGBs28l6CEofkEaCKDVn5p4NZ+udNkslgJTIZ5BgpXJTy:wsvY+5Bs28l6CEofWPR5pDu+sT6pXJ+
TLSH
T155969D13F2A501E8D05ED674CF3A56329A317C4A4BB0A2EF269436E11E75ED47B3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3596	DiagnosticsHub.StandardCollector.Service.exe
2380	elevation_service.exe
2348	elevation_service.exe
3924	maintenanceservice.exe
3208	msdtc.exe
928	OSE.EXE
3636	chrmstp.exe
4572	chrmstp.exe
5320	chrmstp.exe
5384	chrmstp.exe
5356	alg.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	DiagnosticsHub.StandardCollector.Service.exe
\??\F:\	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
\??\F:\	elevation_service.exe

Drops file in System32 directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\50981740c665fbf6.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0001000000017066-116.dat	upx
behavioral1/files/0x0001000000017010-115.dat	upx
behavioral1/memory/5356-879-0x0000000140000000-0x0000000140167000-memory.dmp	upx
behavioral1/memory/5356-899-0x0000000140000000-0x0000000140167000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\chrome_installer.log	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_141359\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4192	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
3012	chrome.exe
3012	chrome.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3596	DiagnosticsHub.StandardCollector.Service.exe
3012	chrome.exe
3012	chrome.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
4488	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
2348	elevation_service.exe
440	chrome.exe
440	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4396	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeDebugPrivilege	3596	DiagnosticsHub.StandardCollector.Service.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe
Token: SeShutdownPrivilege	3012	chrome.exe
Token: SeCreatePagefilePrivilege	3012	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3012	chrome.exe
3012	chrome.exe
3012	chrome.exe
5320	chrmstp.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4488	4396	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	91
PID 4396 wrote to memory of 3012	4396	2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe	99
PID 3012 wrote to memory of 4340	3012	chrome.exe	100
PID 3012 wrote to memory of 4320	3012	chrome.exe	103
PID 3012 wrote to memory of 4320	3012	chrome.exe	103
PID 3012 wrote to memory of 4192	3012	chrome.exe	104
PID 3012 wrote to memory of 1224	3012	chrome.exe	105
PID 3012 wrote to memory of 1224	3012	chrome.exe	105
PID 3012 wrote to memory of 4436	3012	chrome.exe	106
PID 3012 wrote to memory of 2420	3012	chrome.exe	107
PID 3012 wrote to memory of 4436	3012	chrome.exe	106
PID 3012 wrote to memory of 2420	3012	chrome.exe	107
PID 3012 wrote to memory of 1952	3012	chrome.exe	108
PID 3012 wrote to memory of 1952	3012	chrome.exe	108
PID 3012 wrote to memory of 4620	3012	chrome.exe	109
PID 3012 wrote to memory of 4620	3012	chrome.exe	109
PID 3012 wrote to memory of 2748	3012	chrome.exe	112
PID 3012 wrote to memory of 3636	3012	chrome.exe	115
PID 3636 wrote to memory of 4572	3636	chrmstp.exe	116
PID 3636 wrote to memory of 5320	3636	chrmstp.exe	118
PID 5320 wrote to memory of 5384	5320	chrmstp.exe	119
PID 3012 wrote to memory of 5988	3012	chrome.exe	120
PID 3012 wrote to memory of 5988	3012	chrome.exe	120
PID 3012 wrote to memory of 6044	3012	chrome.exe	121
PID 3012 wrote to memory of 6044	3012	chrome.exe	121
PID 3012 wrote to memory of 5576	3012	chrome.exe	122
PID 3012 wrote to memory of 5576	3012	chrome.exe	122
PID 3012 wrote to memory of 5572	3012	chrome.exe	123
PID 3012 wrote to memory of 5572	3012	chrome.exe	123
PID 3012 wrote to memory of 868	3012	chrome.exe	127
PID 3012 wrote to memory of 3956	3012	chrome.exe	128
PID 3012 wrote to memory of 5084	3012	chrome.exe	129
PID 3012 wrote to memory of 440	3012	chrome.exe	143

C:\Users\Admin\AppData\Local\Temp\2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Users\Admin\AppData\Local\Temp\2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-29_1fb2e2efd2f997ca3082e18eff30fe74_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=154.0.8037.58 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x318,0x2fc,0x31c,0x2f8,0x320,0x140718568,0x140718578,0x140718588
  2⤵
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb0cdec728,0x7ffb0cdec734,0x7ffb0cdec740
    3⤵
    PID:4340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1684,i,3686781734979276810,12337931110685084319,262144 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1992 /prefetch:2
    3⤵
    PID:4320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1580,i,6624852279433857965,14488591392424492664,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2380,i,14650459300915627447,17310308284978305764,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2524 /prefetch:8
    3⤵
    PID:1224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,5285374194395060461,3449377017977677047,2097152 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3148 /prefetch:1
    3⤵
    PID:4436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3140,i,13024081901341642533,2244443166709516421,2097152 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:2420
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4444,i,2557594842116879506,7899397236699088238,2097152 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4420 /prefetch:1
    3⤵
    PID:1952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,1495854679291867316,475480894507237476,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4656 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5328,i,9782795520194728512,17787436424841835389,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:2748
- - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c8,0x2a0,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
      4⤵
      Executes dropped EXE
      PID:4572
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      Executes dropped EXE
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5320
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2c4,0x2c8,0x2cc,0x298,0x2d0,0x1405755a0,0x1405755ac,0x1405755b8
        5⤵
        Executes dropped EXE
        
        PID:5384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,8842861108017357739,12733144526668729964,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5960 /prefetch:8
    3⤵
    PID:5988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,8247877979298333961,12807694394423664793,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    PID:6044
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5456,i,8572437170563627379,1367055892716390439,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5728 /prefetch:8
    3⤵
    PID:5576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5960,i,18340242665390429752,5698133026589156612,2097152 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5344 /prefetch:2
    3⤵
    PID:5572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,7039206040030849883,7455711599968430173,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    PID:868
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,12571599003677188850,14174487070104706766,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:3956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5572,i,12102861302120452808,2807284776154343611,524288 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5528,i,16872253319947066063,16905319173706356260,262144 --field-trial-handle=1996,i,11411679905706046617,7150741928723479353,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5900 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:440

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2348

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3924

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5288

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3894554e033f97596666eb7da15c46f78e86d65072f3cde865747944575c3bdc
MD5 153652523b482e869265c2ee4c1316b4
SHA1 2729443a192fb24b4f526ba1911593dc538c5d9d
SHA512 7da87cd524d90c10ef795dafadeb944617feef492212dea0527e3ce4a43e2c23f8a87b619926c083255f213cefca760721c1038a89454158acbdc11bf13d1060
SSDEEP 49152:Db+632BuPkFKRrdE6ohQstBhuXjfS4LWxnUb5+Pl6bJTIZ5jdgp6:h3q6tjB7slgJTIZ5Bgp
TLSH
T1A5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 28a7941a8d6596762f759c817a51fb1b63e56fd3f7caba7e2b20d84f6e160b7e
MD5 38fbc0d6ad86d32a17c924a38991ff55
SHA1 615af34db9d965f323a968097a93da4e0feba0ae
SHA512 fb6d706dba1f6bd93bc0ba633c693d6edb72cfa6cb71eabcdaa736362915c4d5bb521d70c366b9d362d21d02a683890ff8a7b3572057f2e91542278250269506
SSDEEP 24576:4XYfDtczAkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:vtcib5+Pl6bJTIZ5jdgp9
TLSH
T1F485F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 c0564526af6cbfc48634e71746f4ca6b1fec08d473ffe049c336173371ee3d7d
MD5 31b3652bdb7ea37a0374d2eab43d9f07
SHA1 4af6cf1396aba42f99707b4510bf3234bd195ea3
SHA512 c797dfe536012b9daddfd8bf99428b3af0750f2ea57510ff80a2f8434e07fa04e1a123d9c7ca48963313202f30cae9d3f603b850316de8070630b3e687822631
SSDEEP 24576:u0Le5ji0hmxdrM2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3u:uPji0ArMb5+Pl6bJTIZ5jdgpE
TLSH
T18F95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0812ed5718de5406d12155814d4c04caa45eaa8b9ff1814478fb7bd1f5d233fb
MD5 15c05061631366a865a396dadf07ca07
SHA1 8ba2b7c52edd1f9852622bcd6b810f975dac43fb
SHA512 8c932b193c14850b372a68d72e31417004e2591a82f09b1ffc1b417da4812ad48acd1b783e9ffa73227ad8ca14ee61de9035660323b27554ec32c945afc2c45b
SSDEEP 24576:1a7/ezSC6vUyDZaqgrvWx6q8wyuImb57GBiOl6a8JTth/RWZvR6wQQ92pN31:8/ezSC6vURPvMHjyAb5+Pl6bJTIZ5jde
TLSH
T1FB756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5d80f6eb464e59f124f56566d8cef3589ccee1ab2a9119ae74d7810c2f5fa027
MD5 b742b2e353e81648c1fc697351be6243
SHA1 ef19a04bf651f64da529705613407065553bf34b
SHA512 41a1b47eba8b9da26597f5dcfec4a7a58cb0867cda68bc792514d4452ed0a6a263ec8ff24f927ec85fbcacbb4ccb3130d4d72ad4fe0bade27cd32f99475aee1b
SSDEEP 24576:bVbqPb88hv/lV73mb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:bVO88hXlVib5+Pl6bJTIZ5jdgpM
TLSH
T171559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 0fca3df6d695adee64ca9fcaaa4891eda249d8199be5254c236a9ba26ae193b2
MD5 167c048d191dd59ac8f6e22e14e63d0d
SHA1 4c6815a8f882978139eb999bb894a13a97e8f352
SHA512 35bdc81ae0bba6fcfa62714fd7130359cd66634cba6e2d155bb5153a5d4f997819e1f75a460714e00bb62a3f34324dc79138d9523090aea09b695486e87f2b10
SSDEEP 24576:fFamb57GBiOl6a8JTth/RWZvR6wQQ92pN3a:Hb5+Pl6bJTIZ5jdgp0
TLSH
T1816523834A6A30C5E5AB1739D9CDDF00F879AF55CD866BB6C575282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 bfcdddf8cf61ec3d1d14a5dd4729481e0fc86e4fafa823c7e35221b954d0b3bc
MD5 35bb8b2bbf50974cafb0371d741d260e
SHA1 364c2f979f67a5bf38d2db81929e671ddac8ec8b
SHA512 ca41baa619f9c725af4361e681c6bb1992e23b4bbc3a697591eeed137287e43ecfd13c300a955283ca7b588a1c6065227a8739fee5e24bc7b3499e5a3024f1a5
SSDEEP 24576:PJIUPmb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:PJIUOb5+Pl6bJTIZ5jdgpP
TLSH
T10885CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c2d307b4efc4e8fa3f49498ce06928406a02e0504a4ff459797cf34c5f79ec22
MD5 55cdc4aa540f07d507f7754964b848b4
SHA1 9c786d9517650aaca7b3d5f29b960888c0e9a430
SHA512 50b23a324c773f6d3646d396ac45de91bc9daa42461ed33b97a207f0efd9f072112bc4e15671507583b4f0c22d09ba22ea96b9980240e411926fb7820b03f667
SSDEEP 49152:CQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THg:CQvGAdlCEL8c/pRNw5CTslgJTIZ5Bgp
TLSH
T1C4266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 c17d8b1aa7b9b89f346a57aac28023d7fbff88dc6a3d21b56efdf2e189a3d18b
MD5 f4f00271be21208e19fe9369d2e64a51
SHA1 b35b7e577b72e560df26dc1e6c83253d42a92e0f
SHA512 c4419db61def1de0ce59d6161956ada2e9856f71ba9bcd7fef62abecaaa0b06eba06711f4ac436bfdc3bb41015bfdf022970f769211c459bc6e4bf325a56405a
SSDEEP 24576:sBewsAjhmb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:Mlj8b5+Pl6bJTIZ5jdgpl
TLSH
T17685E031FE75E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9cd9cbc8ef976c1b7387fbf121d31d767aabe5641e18d5e6e3097e305c15399e
MD5 855e197f1d812b86146646a95a650b62
SHA1 22eabba6bebb4b84931aa53f153b8a242d0293aa
SHA512 6cf775c7bb82c04fce3144b69e27955807c14b5b69d223b2d82934b100e5eccbee236267a1e17c6e50a7fd5ea521b80a505c04bb7171a8843526b1a30beffc5f
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHSsT6p:wUEtQevvqc2W1cpV29I32Ss
TLSH
T145474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 75eb3d95e06b534d2b48e7811c2448b0fb445a4efb1c974dde4eb52d67980c5b
MD5 3ec618e7b079eca8b4457d26d5975538
SHA1 3186f44204c2748ad743a86d662643c4f869d721
SHA512 c230b1854961ca34f609caa900ac246ba76997b2773f021018e5fe15e72bc82f70a6ace68f28441352fe51444a2750a87e75e383f68624d015fffb36d1c9ee75
SSDEEP 49152:nCbRquA/m2yL5zTfFiV+XenmE3/zcb5+Pl6bJTIZ5jdgpu:woquVjnmXslgJTIZ5Bgp
TLSH
T1B6D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 50c0dbf35b466b244c082cb6bade7bf59c4dc18bbc5e5b3e8770d09b5aa9fd66
MD5 7b4233b3c1b62462fcf4985b75e9bb04
SHA1 cc859c07aec507e0128b7f5f51b3d9ce14b008d3
SHA512 4315e431c24694c63975e1458761413a84d8c2036ad10aa7dcb3cf11244a1d6609f39816bdfbabf90954277683a143eb6e2cf5496b02776489c262d05eda40b4
SSDEEP 24576:XAhGLmIFoiwtA5l7S53kmb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:XAM1Foiq5Db5+Pl6bJTIZ5jdgpF
TLSH
T1E3359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 7600acda1aaa7c9ed08577877ba790142b97e5f60a3223fd7667b53c4704ab02
MD5 853954d7e439cbd6ab48d72049c60776
SHA1 d7176b86cb83905b01e4fa39e77c2527cbc0b49d
SHA512 d66515149ce0692b0a05aa8c5823d0c22e9b0177a24facce853be612962905c5d22d5eb59064e18cd4388f8a0c91469938496508c644beabeb7f0be2547986be
SSDEEP 24576:dwuYOWdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:dwPO3b5+Pl6bJTIZ5jdgp1
TLSH
T17475F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 be64e88504b01298d85c806e81d2aa5d79a98ff36a368d04a2cf10f8123beabd
MD5 ca9c6add4b256e84ea99db86af46f46d
SHA1 b41138a1e0d4873df48494f8c91572c90d1de694
SHA512 b4a28ca150fb9d3eb0e24d2e7a9ff6e8b2cab341c3a23466a3d7fe669ebf16ebf53e4dbb395c2faa87864e2e3308fe448a2e17866c86918dcd46f93107fe21f9
SSDEEP 24576:FZuumb57GBiOl6a8JTth/RWZvR6wQQ92pN3Y:ib5+Pl6bJTIZ5jdgpO
TLSH
T19C65128627A830F9E0A7523DCCE58B01F772B8529B7653CF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 0eb0d10dcae9158c1a333894b8f7e680471b319862f067a7f99f0dd3433f699f
MD5 db669b7558b0ec7af9cdbae2bcb38d08
SHA1 586f911a5666183f01e4a99d615824083641d27d
SHA512 f522c7af8ef52d2dca1947235c3a5301be8553a0a89323922cd121715601a25df472de7512c77ae44e389fd3fe4e3f3c2031633f5dfc443116609aed989b8b04
MD5 SHA1 SHA512

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0f4f49f9cfacab882e21fb59dbb94529d01dd451ebb7ccb5517f8a64974d00be
MD5 71337254aa23a80ff5c5a56e4101261e
SHA1 2327f8b9bd55fdf916f0f2571006f64bd26158ba
SHA512 5fedfb3d32d36f15fc861231cf297aeb56c170930010a4130a3cddc5242a2e2947d5cca4071b239af560d22ffc49ed7390814fe8e1e97f82f539ae9bd1ea6499
SSDEEP 98304:sQRQyi36YOcPuLvw2gAf+PN3YslgJTIZ5Bgp:zQyiKakX+PNIsT6p
TLSH
T1EB666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 910d0ba95b0a81a0319d4530fd9d074301496bf2006a97c97062adc2fc2a5495
MD5 47e4737b4a4612d74bd7c029e159c718
SHA1 e4ddfbeac5ef85127aa8dab27c035ba5d9290120
SHA512 90fab79a00f31c41e8dc8e7237f8d84f3e1b00b2332f8558e39441d94b52840cc48fe7b0e13cd55ca00001b801b00d7c97e65a545cb4c13fc8d0011be13e4525
SSDEEP 98304:LQRQyi36YOcPuLvw2gAf+PN3YslgJTIZ5Bgp:6QyiKakX+PNIsT6p
TLSH
T1F7666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e26857a2b1a12da630a0913218496c872b7960332504f06a2da4512a5563bd82
MD5 f04aaf38f28283793b1cef846d5b73c2
SHA1 6f8d261e90d6055a382006c0f905b2bf1d383566
SHA512 33761027c9e0a028303a836d6dcc6362be44df56e340c90990413dd7b5bcb96470454b7c0f1377df14ecf521fc4779eb372e5d8c282a5de8fe00512c31efbdcb
SSDEEP 49152:Y68Qg55nhxeWu7PNU3/Mb5+Pl6bJTIZ5jdgpy:ithGRc/qslgJTIZ5Bgp
TLSH
T1AEB55A33B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 08a40c4ec8863bce49801b26adec8c7a9833c9c41257adc530b4b66d3a989909
MD5 ed25b65d0e2b5f3fcfe9e3a14576bf24
SHA1 9bd0d997186a25d0f51adbcd3a4f3eb9818a7a5a
SHA512 dfc275621bbf676008ee25f7077dfb58c4dcdbd402a412b90487b0cc8c64ffb63612b4e7079e6c96765334cf823bb93d40217cc96171c36dbe20061133ff0d95
SSDEEP 98304:jy5112gYy5azzVvD69nLKnhZBslgJTIZ5Bgp:+LIH+WhPsT6p
TLSH
T1CB167B13F29900E8D05DD179878A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d692125a5e836881de5a471e826fa16e4d0d2aadc438bb6d5fe5e45e5f12afc4
MD5 dab7dfc4b47898995142178e60ed7ea7
SHA1 f7faaefa0779637528af0c4c8cbf32f7c3d566bf
SHA512 2cae85cc6b64d6e20170f1689932cb325ac6ca51563c2a2cd9c4382e6be2ead5d683373c3874b73e0ea9c2161b7f69a9555b601b8dd4c81e528be7613204c794
SSDEEP 49152:YB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gljb5+Pl6bJTIZ5jdgpk:yu6JmQxd2dHslgJTIZ5Bgp
TLSH
T1B4D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f212890960b4cbc79ebde8bd86e98e9281e57a67bc6ee50d908c250e1c010379
MD5 638aefe27955252d9154ded846de3f8d
SHA1 95f5082ab415901f1b5bac31a85175da9c32bcdb
SHA512 cf7325e76af01915e7556e67433a8df8107f167fd3b20a8db936ebdd797eabf985de9a6d6117c9a0c1fdee0e7e57c9eb8ad7e365f37fb7d7c1f6da0c2840f386
SSDEEP 49152:61hpsNoJpF1A6yU44CwH7R4xub5+Pl6bJTIZ5jdgp9:6mifPVRXslgJTIZ5Bgp
TLSH
T17EB5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 92ea5f5d537caf3c14baae63c08c75eae72aaf1e7c9f14e617abe314793d3e9e
MD5 8e18d94e9a065ded857fad1677f01866
SHA1 d5f5f2ab36e3cc60f72c4f7a488a156751db61d2
SHA512 26810b60d3cb0c6f1b02112cd585853223b0cac595890ef570369f679aef26661036c52d9e622bb0ca18d15a99d9cad86820b43430f7c224a86f9b9a977d2414
SSDEEP 49152:XSuZQIY0Be2KIRVtOnks6NMHqRb5+Pl6bJTIZ5jdgpR:N5dKOi61NslgJTIZ5Bgp
TLSH
T1A3C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3636_13435216560401629.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3636_13435216560401629.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5320_13435216556083300.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5320_13435216556083300.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 905f45fbcb666b647b9e506a44690ab3a491aa07ee9f2612173f253ff5bd1fe1
MD5 544214316a4ddb472823d7b376ba6488
SHA1 920b235bc11a99b86dd16e8a92ae0e55de4d7ffd
SHA512 630e4c226567403ae15dbfbe09811bd295905f27b25d2ace9e48dcd04afce961ccaf2e0dd9424c98895b92a7d8a2a319c122f5ead59fc24712e4f3e5bd727f90
SSDEEP 49152:7htSn8EApI0figGgiDn0AP5wab5+Pl6bJTIZ5jdgpx:aX2i/phrslgJTIZ5Bgp
TLSH
T1CE95BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 891c046acce64116059bdcc6e516c848e7a53bdbbec98dd30aa2b9fb73220374
MD5 e74f0ea081600d90b025577b70013446
SHA1 d1ab54b8403444e20028972a540959582db04c77
SHA512 45e8bc301e5d30559e3247583838d201f6d108bd9bcae7700829f477ae4f6a9de319e57c9604eb099a39020b7b8d7f618b2a5c0fe669c8aa7c14971a7f718e1d
SSDEEP 24576:uSmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:ab5+Pl6bJTIZ5jdgpC
TLSH
T1416523824A6B20CAE09B5779D9C9DB00F87DBF57DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 c8e22bb81513168a2d54c6839263e09cde4bee84c1fd70f76d86b6e158c60353
MD5 625599e9d48c82ea28c3e9d938bf53c5
SHA1 c71d5bb698c8bbb031fd62e20f70ec6bf874f43a
SHA512 1a5a876ab161d7a112f570951e61b90fd45782e820f18451fae92ace40aef3f43d3960a3131758882cb1c2b890595b8c8f9c98481e502fb2094d43cf77aefb9a
SSDEEP 24576:UFmb57GBiOl6a8JTth/RWZvR6wQQ92pN34:Fb5+Pl6bJTIZ5jdgpC
TLSH
T1526523824A6B20C6E09B5779D9C9DB00F87DBF57DE8727B6C67D0827F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 c211ecefc08f1b062f1899f5e874ddf5e4661687720c084e80cdea91c07dd5ae
MD5 4e771a8b99ddc4524bbfe9872fdb4978
SHA1 c9fe05826c0032306b222635854132ead0971d61
SHA512 a6f49a56665e7bc11177013f88eb4b96dda05d0a8a88368bf69bdad2fbf27b3ad692fbef360536126c8780ce5b85f53cb102e6ddab4d37195ae2e7fb34fefdc9
SSDEEP 24576:CHmb57GBiOl6a8JTth/RWZvR6wQQ92pN3N:Jb5+Pl6bJTIZ5jdgpj
TLSH
T1D26523428A6B30C6E09B5779D9C9DB00F879BF57DE8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 0ded9367149599c65c17acf701224038a79b120940fe7d1669f4eb61f337c795
MD5 e6985831cd97beb061ae46b3a1f13abc
SHA1 d6781ad11d1086d8c412b2ea8cc8d977b65ee4e3
SHA512 7f784b7095efa640c000d6dd280939748ce6c12ab8d1b315740ec92fa07fe3019d425141edf558a79dcf0979e41268892f995e5600a4dde268dad024f3e8481d
SSDEEP 24576:amb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:Fb5+Pl6bJTIZ5jdgpj
TLSH
T1B96523424B7A20C5E4A79379C9D9D700F4B9BE96DF5267FFC675082BA931388383170A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c1c43247a420be442caa43312d20c45a62dccc80b6accf4aeb9a8b5cc884c6a9
MD5 9ed8dd3eadb09dd216066d2ccc176223
SHA1 15d9f3c3568ebf3039d2d88b4ac03a8fdbdd87ed
SHA512 d2a8bc18e6e40011cabc7f1e47459d69dbf0ffbf61c0de4b7e071c3da157c106d99da87812dd1ea524c16520490592dbef2e9591bcfe4327284fbe26dc4bdc0a
SSDEEP 24576:bMmb57GBiOl6a8JTth/RWZvR6wQQ92pN3J:Pb5+Pl6bJTIZ5jdgpL
TLSH
T19D6523428A6B30C6E09B5779D9C9DB00F879BF57DE8727B6C67D0427F130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 9dbed16a19cbc2749479f57c02c58659c5aeb2d53cf7294a196e063c2ad35297
MD5 f56fe4884d27df7e3937d20e7936fb72
SHA1 b5c6a79dbe0a6baa09db13e25d6b2d4700cbb663
SHA512 696cae123be2d66eb1866a0503853f19dc89f493acfea36bacb6705da062313e7463a8899f827b47fa96363e6e156f98f5f8fbd5f5d6ab26167b07d60be63bad
SSDEEP 24576:U5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3U:7b5+Pl6bJTIZ5jdgpi
TLSH
T1A96523828A6B20C6E09B5779D9C9DB00F879BF57DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0f1d39451c5030eccbbcf9831721e0c98ff8f1c5e946116d4ce75777092b55cf
MD5 53b397b64e5983ee9ad3a6691b2b3dd4
SHA1 6999f148ab2376f647c8ba4b359a1446cc27a0df
SHA512 b841379a4cdcf73bc718d230d11bdac3668709ffc01b0880e6a983564e7311e3122ab69734e66b752c01f668e6635e594bf18934b913af336a0e85535f2e2608
SSDEEP 24576:Etmb57GBiOl6a8JTth/RWZvR6wQQ92pN3c:Nb5+Pl6bJTIZ5jdgp+
TLSH
T1CC6523428A6B20C6E09B5779D9C9DB00F87DBF57DD8727B6C67D082BF134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 5d848555c27ff7aea06b718a496b0acaad7d9bea4d764bbddc7c445c3c16b16c
MD5 c42dc5dd3c290f779aea1c2f9cd202aa
SHA1 ed1aec2e51db55614c89e9802911da88c3782438
SHA512 4a7c24ed9189066e631c95d2bde11bcf0e7e8fcac7865c69262f8507b5b41c8c1cecc26f66da80b511765ad5dabbede220f491d656487e914d8bc8972d5e7072
SSDEEP 24576:5ZMYzFVSOlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3e:5ZMYzfkb5+Pl6bJTIZ5jdgpo
TLSH
T118850295B36118F8EC67823ECD958A05E5B27C5A4B60C65F03B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 2.1MB
SHA256 362cc5ccbd56a1bf027943f6e0df365b580ad329ccaf8a611e496ed6845cb215
MD5 e9e03783b77a7fbf7ace3a0366b71342
SHA1 41e2c998fe3253339d2e6a7718622a5daecea879
SHA512 1dcfcc2d33756a05b67ab98fb0f95dba626576ce75e319f7e16b0a6a5cad5f7fa727e061bf5681bc7c3e05abde7aeca488f2aa5baafd2fd150372a9aa0508660
SSDEEP 24576:Nemb57GBiOl6a8JTth/RWZvR6wQQ92pN31AaKngL2jdshRTdG1YxITqvfPkbIcbW:7b5+Pl6bJTIZ5jdgpzAarSj8RoTCCW
TLSH
T188A5338BCF8A5684D45B2B78EED9EB487CA67F8EDC4B175CC9F4182DA5393C43429104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 2.1MB
SHA256 22a9786a86f8688d704b54108ab13b2cd9f3577c987f1738e6a809620bf6d21e
MD5 46f307eaf733e343fcb1b5391442f006
SHA1 2e1edb6d81149e41dd7790a8abe6a1ba87698ec3
SHA512 fd0168e13960086ce5a94491feaaf92a7f42f86b6de87e2aab100d6cbd6e8d794cad45b75e6688ba93a306ae8ff1b65e20b9de565fd97af3bfc955aef9772038
SSDEEP 24576:BKmb57GBiOl6a8JTth/RWZvR6wQQ92pN31faKngL2jdshRTdG1YxITqvfPkbIcbW:zb5+Pl6bJTIZ5jdgpzfarSj8RoTCCW
TLSH
T1B9A5338BCF8A5684E45B2B78EED9EA487CB67F8EDC4B535CC9F4181AB5393C43429104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 2.3MB
SHA256 5999fa608980755fbca68779fc4045a8aa6eb712a50e3e0c517e8b18922c1ee1
MD5 9e3e9373c8a9527cd5a6cb2f5e33a397
SHA1 aa19385f73598106f2f9d628e04d98ad5b8b2350
SHA512 142908f0fdc93cba027abf1fc1313601d58346206bdae147e4bb8a9cae0966aa0a345ad2706ffce0b5a604315e006378ae0090909c80cd3f02a9580b13b4267e
SSDEEP 24576:yzyRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3ZIaKngL2jdshRTdG1YxITqvfPkbIp:yXb5+Pl6bJTIZ5jdgp/IarSj8RoTCCW
TLSH
T157B52347A79521F8D0675338CCD65A05FBB2793A8B068B9F87B0067A6E373D06D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 da036bf990123ffd4330be5b9bae03d04186c28d2bc394df0b1deb055958e372
MD5 b52a257822405b3a74108b581cac414c
SHA1 553240c154caa88b1c360277b6cdb1cd199267f3
SHA512 3921fa8709a701e98eb156455362dfd25c4e9c1af4931a76528e149a79c908c04c2346017d081446583e72f18a1d60c5a98edbff70272f0ab72f056e2aa7c269
SSDEEP 96:sJCaZzMrONmv4lE9lhK3BK3EmLljsfcAihK2OK2rPMqAvKE/0:eOvvLelYjfcl6KE8
TLSH
T150F1F09AAE02487F3B868B3B338335506DAF241AD7D4907277EB6552F0CE9A5001F5A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 591ee8bc7adeb1e1f217400f7abfe009f94a576ee04c4151452ae9ff5ed58371
MD5 79f97e671e77b8deae568b49032a01eb
SHA1 d757c413b15f8c0536327c08b4261276da673e46
SHA512 5d908aaf92fbdb4c43af7e6c834961fd868067ad1d8d41f915b6a4b2bcc50b693d2196669c6f17b7eac003b9e332fcb3cc5b8b04f4ff5ef9b6edfcff19f1c56f
SSDEEP 96:sJCaZzMrONmv4lE9lhK3BK3EmLljsfcAihK2OK2rPMqAvKE/qI0g6kkK6YhK38K6:eOvvLelYjfcl6KEZ0XkkF2f0Y
TLSH
T15312FED69E02487F3B818B3B334335616EAF240AD7D4907277EB6202F0CA9A5012F5A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 4aa69d28c33a1d601552f6bf0233442b3be043b93d4552b5a5debad3aa3dee04
MD5 c9a624a2994024ada45025d549192489
SHA1 7e0bb954db744f337dbc86742619aa971a0dbdca
SHA512 6e153897f8ad550284e427a4bfba5990c54e321f44ad1537adc932bd455622b9221f4fff84d4293a1eb343e013c29896369aa0227a6f4bb9ab869e0f0e68bea0
SSDEEP 24576:Gumb57GBiOl6a8JTth/RWZvR6wQQ92pN3V:cb5+Pl6bJTIZ5jdgpH
TLSH
T1CA75F14AC29811D8D06F6279CB858A01F7377D658BE293DB46E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 dc9d4ea1a0d2234ba87172621e2d28d04167e6b25474afb91e4207131ae8905d
MD5 237e908d2570882e7d8f3ce9bb973e2d
SHA1 be26bf703bb84da60789d9e9901766e39fb0944f
SHA512 55a184cc7259eddb35ecfed53a5e0cc1e1722cf835456c888c2127e1fa53000b9d75f8013770fdd81e248d36700dcee2798650c9ee2911370d4cf2e100380f36
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 3b844068ec672ac679d2f4fdff1478b90e1a64a6cd8ddb0e4cf1ad2d8975c42d
MD5 e32700c21e613abd2095720d8f1b9119
SHA1 08313f9152d1370d7a5677b1ef853f0161c31f6a
SHA512 8a6ae130446092fb91ec1d9ec64697b58fa3e730dbf02881b18e1ab3c351be33bba4442acd8335fd82a40fbbc356f02c10bc86e1997f4600059d371a856163ce
TLSH
T1C4F0F4A5C921EC7718FD075920680B47FB51136B2AD1888B3E3D920C8FB163B868981C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\service_worker_bin_prod.js
Size 136KB
SHA256 3d98261dc84b114d5b0f29f2c47fc08ae9ba13b177f100d740e413d5716f5c1e
MD5 9d82da2d26e815161b54d9e21e5448c2
SHA1 8a00f666e1baffdeb5ce0fde0e109bcf111ff724
SHA512 5520ab30df09a3582e7d3ac3fd756b257d0dcc75bf4007b28151f063883046caa4f459125106d46ad99f5bb7f0bfc557affa5750aa51b5d99e43e73cd11c5926
SSDEEP 3072:eR3MbbdKe2KTOtBth8CyOMGL2y6GDiwYxyrxygCpYK:eR3MLRRA2y6GDiwJxlCpYK
TLSH
T1DBD3D9CCF6A5B0124363A5F5402F000BB23AB8B9E44C85A8F288D9E97D7556D8277F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b4b73beee9f62e494f87e93278a8278bbabdd81cd2ae495c836c49aafe75f610
MD5 4c3d734ec7e439d947b46a5ac84c23ec
SHA1 00a785c123f0cde271964e7a216de25f9b7689b6
SHA512 eb14f8c3b2d2f2682568042848a06bc9b215ee69b48be177e13f054a6c2ff1b7f26e6b00a552c5dd83cfef828ccc5c6eefdbf97531f7f17b7f6925872fa0e6d4
TLSH
T136517CB7C3D8867EC80156E49B217E2FDD6D0A18522C3C56C8D8AE5F53E28B2D20135E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 0d0f9b9ec169b91cc6ce2413ffc17a6d2ed3fc3b4876704f6f57a89b279933e4
MD5 a49239935da58f11b196461b2eb48478
SHA1 ab631468842c6a22042a2f80e48572863817a142
SHA512 66c2793796fde6398c29474e852f12c237a367fc217dafad4fdf7a27b52d99adef894c259ed45403de4e6f4266de958db13c57d59494a0cc8c7c822264890796
SSDEEP 192:eRlhNhCtv7GG9PRp2WXsb+WNng32Yxwkw+uZiyIsnAUgtaJ:eRlhNhCNDXdXwQ2DeF8
TLSH
T16622B42CFD5179BB5CCAD21AEA227763D3F1102130D42E8CDAF9992C14EB5CD6227867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d3ef144a0ea86751a1d7c98e3d60300414fe66205403698525e499e60044433c
MD5 7fd4749f9232b9bd4b8cc79d80f50a10
SHA1 a4fad9c72b791f783168d764cf9c0f7f732c79cb
SHA512 11a42fe8665cc682e85cd4abe2fba3173f0b8385a8374de98d8dda6a1334266bd9c1b67b64d541564e4b5b0b22c534b1269f95364b89cbe88416df3fffbe4e62
SSDEEP 192:eRlhNh1lPRQ94utv7G+RPRp+WXsb+WNng321BBxwkw+uaiyIsnAUgraJ:eRlhNhnPONtXlXwQ21+ece
TLSH
T1EC42C62DF95179BB5CC6D219FA227BA3D3F0102120D41E4CDAFC9A2C14EB5CD62274A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 ed07fbfba2b6fb917ac0f81432eb7c3b0e017d8937b957bfa5e58f13588028e0
MD5 c5bd25df9dccfe2e8d134f2220d1766e
SHA1 d552fedc2d500ff194bac555ed2937c2001ba286
SHA512 2c37287b32faaca6cefc9db8cc741dfe0dabac09bed8faafd619d0f71044f1fbd85ae46ef3592544c2726e52e117a13be58c0d7bfd63727d2d1a5c2051e570f6
SSDEEP 192:eRlhNh1lPRQ94utv7G+9PRp2WXsb+WNng32Yxwkw+uZiyIsnAUgtaJ:eRlhNhnPONpXdXwQ2DeF8
TLSH
T11132C62DFD5179BB5CC6D21AEA2237A3D3F0102120D41E4CDAFC9A2C14EB5CD2227867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58e6b2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58e6b2.TMP
Size 3KB
SHA256 90a3f7a42b51f2609814cf885edd5f7a35c34e4c178a2cbe38d94917804896a4
MD5 bf76be8bc504dfec3d6d2db6c061d009
SHA1 897f8e311b2a200ebd9fb67c38a6514954211966
SHA512 0442061f3f5add4b276f8f1528224f4aaffdd57c5f57d37c5313e861089164dc84946e04b2c0b208a3b97694945059fcbe323225fb1b78e9816f892413cd44f5
TLSH
T10F61301DC4F01DB71DB23BA5782E0781F992163B1584184A7A3E058C1FB386A8488FEA
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3cf6a5bc6a6294f668267ce65f8603f5eb033e3e584d1a62b973df69d361850a
MD5 168423bba32f84855e06bd1f08852ea5
SHA1 f42b61f8d72133a06502cd93912b9e78e5aedefb
SHA512 86923355374cb38f3afc883dfc80138aaeb94bf909007091fbefa02f5c31ee42fd3dc88ec1d26fb03ff0d2745264e45cf28a904405e7fd8672e276a1233a2ad7
SSDEEP 384:ftjDu7KxkXqKf/pUZNCgVLH2HfgslkEXODDK+ErU3gbHGVCoiTCGS:ftDu7KxkXqKf/pUZNCgVLH2Hfgs+WOH3
TLSH
T157521967A88C9A7F0FD4D98CD8136F4FACF501576568496852FB5C0803A6BCA124E2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 0357fe0ccfb6b013da397a7d7b739c92411579478a4ebfccb22a0af4e3d0b0a7
MD5 bc650f9d83500dc652f639b7682f1cfd
SHA1 eeffae609639bd0141f1cb05098105bbf7a41b12
SHA512 00b275f479eaf0f4a8b83683ed5f735dd716ae4e3e9b400d21475e7d35e2f8a52b68a5bc1483e35f88a471df4ae9341c853010f8756256c9aefc2b9d55dbf9e0
TLSH
T101B0121C808B3740C80081B0351B108826E05E219500070382D05E859C8B5E0C257646
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 3f93b88c03ffd87ac5195f3d6d4d99399e7c7d63c38ffda4390b764211e075b9
MD5 5ee1bbb1b104339f7599334bb3a01e75
SHA1 5c8b1f22097d6abdb021a8608642cff27630cc50
SHA512 3ed2b410e0847ec09b52fd8e61b10cb40cb050e298d7ffdae5bd03a724e0711b39b2de624e2c1195a222b311fe1cfca743cc63842001fde9657e1ad7975e39bc
SSDEEP 6144:vXQrWMy4s+Je+Otv7eSOu6n+hFD+7t56OD9ZfSApprs:vgiMJs+YlKSh6nyFSXD9ZfS4G
TLSH
T1D84422723657EEFB99786102A10B62005DF8FDF892E65E5544C19F4DF2EF4440AB3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 266KB
SHA256 f99dd2a9655cdc990184fecaa6f8ce5543a74c65113ba106471e120c8de5b422
MD5 96733cf3ceddab607c142d7af520e566
SHA1 157d635c3f0354d49e73e3a38428b5684c796abb
SHA512 189b4fe8203154110065a8cf162a60f9056d8f48f3228f6836fb6880d0e213d19a2f89a7edab8d70c2225f62267c8ad37f273a3a2f1e86f84eeec478d33799a1
SSDEEP 6144:5SQrWMy4s+Je+Otv7eSOu6n+hFD+7t56OD9ZfSApprs:XiMJs+YlKSh6nyFSXD9ZfS4G
TLSH
T1704412723653EEFB99B86502A00772005DF8FAF8D6A65E5944855F4DF2EF0440EB3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 8187d8db85f7c5113fcfbc9ba05631f74072852ab8aaaab451919700a349dc01
MD5 5438c401db4c5461b56657f50e40a9f5
SHA1 f5bde8214f89cbd14bff9d6e00f7411ce82dabd6
SHA512 558540cf3f3c60a87fadeb34b25e7238880499c82a914190da121032c5db3df323be9584c5e1db42d5cdd3b52b65c6b35beef26b8484bf9ed35b683ba46ec61b
SSDEEP 3072:7+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gZ:7+hFD+7t56OD9ZfSApprZ
TLSH
T136D31232AA91C8BBC9FC6541B197A300DE626CED45DE3A09444A5F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 265KB
SHA256 0a23c077d69ae609455bfa7771afe1fb4f05cf80baf4ad1d49c021198c04448a
MD5 b86e30ccfb4de162067840cbac0adcb0
SHA1 da8eddc9920549ddb52ae43285dd756d11d4aced
SHA512 d5a6cec57dbc2b6ddb13dab435afe3b4772f75ca3ba3e12b82a633444f34fd9371340a46a58d1660c305063a951677989982e192e636a51fe055a8905378ff8b
SSDEEP 6144:MZQrWMy4s+Je+Otv7eSOu6n+hFD+7t56OD9ZfSApprs:MyiMJs+YlKSh6nyFSXD9ZfS4G
TLSH
T1A24422723757EEFB99786102A10B62005DF8FDF892A65E5544C18F4EF2EF4440AB3B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c40095da-2117-40bd-9d2a-f54c211a48a5.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3012_1939815813\c40095da-2117-40bd-9d2a-f54c211a48a5.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50981740c665fbf6.bin

Path C:\Users\Admin\AppData\Roaming\50981740c665fbf6.bin
Size 12KB
SHA256 c4097d2cfb190415d194d9a04375ad4e91a47dbd03ee54c935b555aea355ec44
MD5 474be176e86f64ec41e15f9c9ce624b4
SHA1 964a0e869556beec07cdf8ac4081fdae9cab8700
SHA512 c32ad5a3aa1b63a5442794e63e7d0869c221855ec0414d180cf857d1b4bb9767ff3ff11fb3b3f6dfba0210f8f5e8db32e305a5529196f9f07ef56f9fc39bcd1e
SSDEEP 384:3Ip8ex2pCL4DTBt/FM2FFIEB3fDm7po9DT3V:YWP7SQeEBbYs
TLSH
T15E42D10F28A464CD23A37D14E02B711C5C9CA36976C61B568621E9E7FE6E86CCF1681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 952fa0574defd7753839b4fdbcf6ae302021aadfae4e8b3d558f62fbd10d5031
MD5 3bb6dc41e2abc77a8f2313819bc72cb2
SHA1 78f648dda4a2e8f730aab68fe0d11548c3e8849a
SHA512 fd454ad3e5f353cbdbceef0c17afa188e446bfb32fe530cbd005ea3c942d90353ce97134abc6296dbd73a617da5037398625bd73ecbb91fe1be7a0c2a959ccba
SSDEEP 24576:ehbHjPmmb57GBiOl6a8JTth/RWZvR6wQQ92pN3K:ehbHjhb5+Pl6bJTIZ5jdgpU
TLSH
T1A065126E06AD20C9F076A27DC5C5C606E731BD265B1263EF42E5813E9F37AD82C35B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 9087ad4c81f01228a525d80fa81b11d5c4c89651369086fd2c378507456cd656
MD5 ade0886673a3372c448d91a5672c46cc
SHA1 636e4526897012d1bfd1f33089a73ec617a89e1d
SHA512 33d6c8c7fa1287708f784dbd3d7f5fe06c55274ac36aa5ea7128affc5f86e1cd296db5a85e0f9ff73f16cc3680eddf8f2d8a19b6598150f520d3c622afd7fa7c
SSDEEP 24576:kiLaKngL2jdshRTdG1YxITqvfPkbIcbjLm:kiLarSj8RoTCCW
TLSH
T1FD05126EABCC61E4D12AA23C69A18549E7B3F168570717DF45E0C27D0E77BE52E3CA00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 cf928427b55d748dfaf49aec6ef3cfc9ad1282299583ddc7cfec427dd4855a73
MD5 ac855aa07d20f94d59c10208effd3b62
SHA1 f21cb7e2d01c44f014e36b98eed667017213efd5
SHA512 af1b5fcd83c43f06614d69c7f4999d76b9d852f07d809870fed140d4acc4d356d2dbba43c4e25e8bbfe07afc51fb0cf06270353846800bc4a5a702cf36cccc34
SSDEEP 24576:TIy2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3H:TIGb5+Pl6bJTIZ5jdgpJ
TLSH
T18675120553A860C5E5BB4738D9E6C350A979BD21DF1263EF81A0A63FAE36BC47C31706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 fc65e1281ab3877ff54b4f85940fa1ebaca5cb3592789db1dcc1e2b128709c5a
MD5 c043f813d298143a11b02b111cf6a8af
SHA1 a32b6888ae2cda0d597ff95a2976a40f9b1e9ec0
SHA512 e011e7c4e0c0db810644e1d43d7810622af206a6c0fd40b5e824943a355e13e6cce728a58c1093533f64c2ac3bfc2a8f29d16d97213b6212f10746e9ce65ef55
SSDEEP 24576:21QT7EcpfxR+N5AWAz3ooiYhjMqbEaKngL2jdshRTdG1YxITqvfPkbIcbjLm:bTDxR+N5YzTTjMJarSj8RoTCCW
TLSH
T1D075C12EA7F805E9D17E86799B23C506FA727821033193CF42A0C17E1E6B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/928-134-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/928-358-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/928-131-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/928-125-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/2348-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2348-300-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2348-74-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2348-69-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2380-72-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2380-52-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2380-58-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2380-165-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2380-167-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3208-103-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3208-109-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/3208-133-0x0000000140000000-0x000000014018C000-memory.dmp

Download

memory/3596-73-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3596-41-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3596-47-0x0000000000670000-0x00000000006D0000-memory.dmp

Download

memory/3636-423-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3636-309-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3636-319-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/3636-315-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3924-90-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3924-76-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3924-92-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/3924-82-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/3924-84-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/4396-1-0x0000000002160000-0x00000000021E3000-memory.dmp

Download

memory/4396-9-0x0000000140000000-0x0000000141A10000-memory.dmp

Download

memory/4396-14-0x00000000030A0000-0x0000000003100000-memory.dmp

Download

memory/4396-22-0x00000000030A0000-0x0000000003100000-memory.dmp

Download

memory/4396-7-0x0000000002160000-0x00000000021E3000-memory.dmp

Download

memory/4396-123-0x0000000140000000-0x0000000141A10000-memory.dmp

Download

memory/4396-0-0x0000000000720000-0x0000000000837000-memory.dmp

Download

memory/4488-34-0x0000000002170000-0x00000000021F3000-memory.dmp

Download

memory/4488-28-0x0000000002170000-0x00000000021F3000-memory.dmp

Download

memory/4488-60-0x0000000140000000-0x0000000141A10000-memory.dmp

Download

memory/4488-284-0x0000000140000000-0x0000000141A10000-memory.dmp

Download

memory/4488-93-0x00000000026D0000-0x0000000002730000-memory.dmp

Download

memory/4488-99-0x00000000026D0000-0x0000000002730000-memory.dmp

Download

memory/4572-755-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4572-329-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/4572-327-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4572-321-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5320-417-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5320-348-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5320-354-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/5320-368-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5356-888-0x00000000012D0000-0x0000000001353000-memory.dmp

Download

memory/5356-879-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5356-880-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5356-886-0x0000000000500000-0x0000000000560000-memory.dmp

Download

memory/5356-895-0x00000000012D0000-0x0000000001353000-memory.dmp

Download

memory/5356-899-0x0000000140000000-0x0000000140167000-memory.dmp

Download

memory/5384-371-0x0000000140000000-0x00000001406BA000-memory.dmp

Download

memory/5384-366-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5384-764-0x0000000140000000-0x00000001406BA000-memory.dmp

Download