7a149ca17585994787b2fbdf2ad92a5e658157c3b5f70ac067b329133893ad1c

Analysis

user interaction
yes
max time kernel
330s
max time network
331s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
message.txt
Size 48KB
Sample261022-yv3dkafs8s
SHA256 7a149ca17585994787b2fbdf2ad92a5e658157c3b5f70ac067b329133893ad1c
MD5 825d05d3902fda873091552ac8c68c11
SHA1 37ac7f4e2b151a5684f841d28d70ae05adc31f57
SHA512 42795bd46f3c40bfd641fff9b415cfaef20c37fc8e4eb167859ad57a69d69f5c49fb44c6372e5e662a1189b1cdbebff49d5830149d8bbb64f44efee5aa28220e
SSDEEP 1536:nJF7tNqx9hqbjigQr904MvALpY2BcYnMii:nJF7za/qbwr904JL62aYnti
TLSH
T10F2396C45222D12F578E8D076E467BDC2868D1AFD5C9A302E094BA4F64BC27BC5E9FC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
128	4380	powershell.exe
129	4380	powershell.exe
129	4380	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1296	chrome.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{F1E9897E-1B60-4922-A30E-E373454F5BCF}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	NOTEPAD.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	NOTEPAD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	NOTEPAD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000_Classes\NotificationData	NOTEPAD.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5896	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4892	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4380	powershell.exe
4380	powershell.exe
4380	powershell.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
5196	chrome.exe
5196	chrome.exe
2416	powershell.exe
2416	powershell.exe
2416	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe
Token: SeCreatePagefilePrivilege	1424	chrome.exe
Token: SeShutdownPrivilege	1424	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe
1424	chrome.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5896	NOTEPAD.EXE
5896	NOTEPAD.EXE
4892	POWERPNT.EXE
4892	POWERPNT.EXE
4892	POWERPNT.EXE
4892	POWERPNT.EXE
5532	OpenWith.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 4492	1424	chrome.exe	101
PID 1424 wrote to memory of 1296	1424	chrome.exe	102
PID 1424 wrote to memory of 3864	1424	chrome.exe	103
PID 1424 wrote to memory of 3864	1424	chrome.exe	103
PID 1424 wrote to memory of 1376	1424	chrome.exe	105
PID 1424 wrote to memory of 1376	1424	chrome.exe	105
PID 1424 wrote to memory of 5100	1424	chrome.exe	106
PID 1424 wrote to memory of 3012	1424	chrome.exe	107
PID 1424 wrote to memory of 5100	1424	chrome.exe	106
PID 1424 wrote to memory of 3012	1424	chrome.exe	107
PID 1424 wrote to memory of 5932	1424	chrome.exe	108
PID 1424 wrote to memory of 5932	1424	chrome.exe	108
PID 1424 wrote to memory of 3892	1424	chrome.exe	109
PID 1424 wrote to memory of 3892	1424	chrome.exe	109
PID 1424 wrote to memory of 4700	1424	chrome.exe	110
PID 1424 wrote to memory of 1380	1424	chrome.exe	111
PID 1424 wrote to memory of 1748	1424	chrome.exe	112
PID 1424 wrote to memory of 1380	1424	chrome.exe	111
PID 1424 wrote to memory of 1748	1424	chrome.exe	112
PID 1424 wrote to memory of 792	1424	chrome.exe	115
PID 1424 wrote to memory of 2140	1424	chrome.exe	116
PID 1424 wrote to memory of 792	1424	chrome.exe	115
PID 1424 wrote to memory of 3964	1424	chrome.exe	117
PID 1424 wrote to memory of 2140	1424	chrome.exe	116
PID 1424 wrote to memory of 3964	1424	chrome.exe	117
PID 1424 wrote to memory of 2800	1424	chrome.exe	118
PID 1424 wrote to memory of 2800	1424	chrome.exe	118
PID 1424 wrote to memory of 2908	1424	chrome.exe	119
PID 1424 wrote to memory of 2908	1424	chrome.exe	119
PID 1424 wrote to memory of 4296	1424	chrome.exe	120
PID 1424 wrote to memory of 4296	1424	chrome.exe	120
PID 1424 wrote to memory of 2108	1424	chrome.exe	121
PID 1424 wrote to memory of 2108	1424	chrome.exe	121
PID 1424 wrote to memory of 4356	1424	chrome.exe	122
PID 1424 wrote to memory of 4356	1424	chrome.exe	122
PID 1424 wrote to memory of 5848	1424	chrome.exe	123
PID 1424 wrote to memory of 5848	1424	chrome.exe	123
PID 1424 wrote to memory of 1864	1424	chrome.exe	124
PID 1424 wrote to memory of 1864	1424	chrome.exe	124
PID 1424 wrote to memory of 5296	1424	chrome.exe	125
PID 1424 wrote to memory of 5296	1424	chrome.exe	125
PID 1424 wrote to memory of 5808	1424	chrome.exe	126
PID 1424 wrote to memory of 5808	1424	chrome.exe	126
PID 1424 wrote to memory of 2568	1424	chrome.exe	127
PID 1424 wrote to memory of 2568	1424	chrome.exe	127
PID 1424 wrote to memory of 200	1424	chrome.exe	128
PID 1424 wrote to memory of 1848	1424	chrome.exe	129
PID 1424 wrote to memory of 3320	1424	chrome.exe	130
PID 1424 wrote to memory of 6016	1424	chrome.exe	131
PID 1424 wrote to memory of 3756	1424	chrome.exe	133
PID 1424 wrote to memory of 3756	1424	chrome.exe	133
PID 1424 wrote to memory of 5444	1424	chrome.exe	134
PID 1424 wrote to memory of 2108	1424	chrome.exe	135
PID 1424 wrote to memory of 5444	1424	chrome.exe	134
PID 1424 wrote to memory of 1352	1424	chrome.exe	136
PID 1424 wrote to memory of 1352	1424	chrome.exe	136
PID 1424 wrote to memory of 4488	1424	chrome.exe	137
PID 1424 wrote to memory of 4488	1424	chrome.exe	137
PID 1424 wrote to memory of 5196	1424	chrome.exe	138
PID 1424 wrote to memory of 5944	1424	chrome.exe	141
PID 1424 wrote to memory of 5944	1424	chrome.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\message.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:5896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4572

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:6004

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0xa8,0x134,0x7ffd58b5c728,0x7ffd58b5c734,0x7ffd58b5c740
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1532,i,1764727962205769482,878604007669613010,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,7385733669755420935,16488109371983771023,262144 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,14666934256481664189,3224067082858952846,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:13
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2708,i,12429126298516357621,17999669319079312860,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,14295610271892372256,1216646172639473873,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,12923833215610722597,6829917574424497340,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4876,i,13760895184298428071,16218484587084800628,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,16032705742554422253,16345752071776029953,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5496,i,6867802347478280451,15003757215054212478,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,5756612989597757432,13889657366714827776,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5812,i,17426125501778001942,8079285439687537677,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,14755331400559173843,3661136785563375400,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5968,i,6001186045450386218,2555960306769288600,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6008,i,11674089946423518834,230867882604062624,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3560,i,9347151572937548877,10156044323725455465,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,7342537761521754610,17749954012297371656,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3968,i,3866350102021086581,16888293817813763087,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5688,i,13616398540597155347,16198156673036686949,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,11032341581436679699,10215881170136868065,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:5848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3580,i,5331541836909682733,3542345209218596,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5684,i,5848019755231282137,12960973257843248456,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5608,i,16776800879229129118,366780607309957125,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6160,i,3043738196062770594,16394230193895318548,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:9
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,12919036025270519764,11618612056601409930,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=896 /prefetch:14
  2⤵
  PID:200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,12073046506512218645,14145637836323471732,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,2017553405137681275,7494201767882785807,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,17798646479389971409,453474157735170949,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6592,i,1125906249338462911,11087608514222103702,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3584,i,10158994192669609009,14316364412401174915,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:12
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5988,i,15473309857519032199,3845712746982567664,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=3524,i,8395223615452255225,817403306638201661,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=3608,i,4691785028515969804,1281909766026550020,2097152 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1228,i,6520423887354510542,11394463035040293051,262144 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,1686570876574083399,815497313671784196,524288 --field-trial-handle=1920,i,16442103659359861055,12149713247270412993,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
  2⤵
  PID:5944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3160

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5532

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

186fe9ea-9129-4603-863f-69822adf7821.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\186fe9ea-9129-4603-863f-69822adf7821.tmp
Size 143KB
SHA256 56f0d937112317c76adbe64d658f12039059d6b420ca0a8a85aa30ac5630c509
MD5 5149a9cc26db4b3dcf6458d35e23d7d3
SHA1 1b301b987afee8c14a4407a2c4cf74aed895a1b2
SHA512 8ffc666131169108ac2a10465237d056ba639723938f058c3b7a9a1262f11d6082b74febecb41689c1dd8ec2bff2943941da0181e23937c2b6cdb5ef00910a0a
SSDEEP 3072:ZiBSIgHOmcvuRYKScVjFRbK26vzilq+1xjU9//LqO:Z5LufuPSCbCbJ8xU9/d
TLSH
T1DDE312B0696DFA4F7112146A733F0A539F2C9AC7C84595C97E8790E6638FC98F603C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

658812cf-ce58-4d9b-b932-2e72df73b10d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\658812cf-ce58-4d9b-b932-2e72df73b10d.tmp
Size 144KB
SHA256 cf34347baa49368a35f104896d849e87726af9f42c1f04954b9c1ca104d8d622
MD5 5e1cf8b9e3ad2d1498d8e7f3e667a6b5
SHA1 d5f8870ac96f22557fb37c0f74bb880a44e2016f
SHA512 6e44f4f2af9257b526d45c93c4f9a081bf2569682754cd0170f96dac073e3264948ecf39eaf6406895dfe82a9bcc2c29aef47036c43335763a44a78819b3f48e
SSDEEP 3072:l5DSIgHOmcvuRYKScVjFRbK26vzilq+1xjU9//LqO:mLufuPSCbCbJ8xU9/d
TLSH
T17DE312716D6DFA8E21221895323F0F535F1CDACBCC04A9CD7E479596124EC99F603C96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a3d00d3-a389-40e5-bebd-071d8c8664d7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7a3d00d3-a389-40e5-bebd-071d8c8664d7.tmp
Size 144KB
SHA256 a2a17e9edc93ccbafa8d6193124d3de53066ed667d3bf3677af9b4af10e0b188
MD5 9c914246742789f728060c0be8fc93d8
SHA1 4511d99e666b5ac6eee751ceb0cadf33946eb263
SHA512 3d944bf98418484b370d5f7e661f4cf15e96d3e75b23b84c346cda1090b1136f9d0293589c2c219d52cccf19c2cde531204356c2c44e4e0603f9cffe1b6bdcc6
SSDEEP 3072:1SSIgHOmcvuRYKScVjFRbK26vzilq+1xjU9//LqO:VLufuPSCbCbJ8xU9/d
TLSH
T173E312716D6DFA8E21221896323F0F535F1C9ACBCC00A5CD7E479596624EC99F603CD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

376958f6-4ce8-4776-86dd-0a06e93b15ac.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\376958f6-4ce8-4776-86dd-0a06e93b15ac.tmp
Size 13KB
SHA256 0a8dc8bae20435f84873d728560879dd780808a06be77c1ad4a40dd3966f8330
MD5 e86df97720e0493ad1ec18f393ee15e6
SHA1 aae28cc03f6090829f543fc7f630ee0630afb76f
SHA512 ed0a61e05acf0303f7c783ed84d08842008fd2781246ac08283103442b4dd958da6fcf15f9d83037ff6002c1ec70b38f08ed342af2079fd4364234f0c8260289
SSDEEP 192:oREcBzsRS/uv72IkPRpVW8OB97Hsb+WNy4lf94Vpe4Q1oWeppQjCrkw2a8yIsnAI:oREmzsYKcXcVwxEUoW+ymrW9E
TLSH
T1C052C52BED10B97B9CEAD319FA65BB53E2F5202125D02F84E6FC892C14E79DC2117013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65b6f881-bc4b-4ca0-b7bd-05a2ca9a515b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\65b6f881-bc4b-4ca0-b7bd-05a2ca9a515b.tmp
Size 12KB
SHA256 482e0988ee9c83db7c044db459e45e66f37a8801c309bb324acc225938a3fb4b
MD5 8c5083291b73e7ff9b7736314d1d9985
SHA1 eaf61b42e78e265922aa66fc2fb44ac427bba14f
SHA512 2a7da10523ba382023813298e5b5c485a0285a31de771e8330b29b37b68d4dfb356eb425784397a9284254a8ce9d56ec4b3773e3b97b77c60875b50442b47a2d
SSDEEP 192:oREcBzd3S/Cv7EIAPRp2W1QB97Hsb+WNybf94BH2reppQjCrkw2HVyIsnAUge:oREmzdOO+XGVwim2r+ymrWhe
TLSH
T19942B42FEE10B97B9CEAD319FA657B53D2F6202125942F84E6FC892C14E79DC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68960b2f-f710-4969-bbc0-9c0a55cab72c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\68960b2f-f710-4969-bbc0-9c0a55cab72c.tmp
Size 13KB
SHA256 1d8097ab13ff143e3f1d5f77b66e71c5a1b1c0d948e04c2d5933b0eb9d2df861
MD5 1697fd2259607923b01df8bc818c137b
SHA1 43a00530765a419c783b448fdaeaa8b61418987c
SHA512 a8b1687bded1b8e1eefd1c6f5b950bd4e6f2b64a3ddc85a957b096a37ad03f8f74b71af86d2351ff26d465c75d18c27e16c1acb9628454c9f56cfc9ae8748819
SSDEEP 384:vBjNU7KxkXqKf/pUZNCgVLH2HfgslGmXODNc+ErU343HGf+LS/hpYkp:vBNU7KxkXqKf/pUZNCgVLH2HfgswsOZ7
TLSH
T109520A27A84DA63F4FD8D68CDC13AB4FADF5018765A8492452FB5C0903D57DB120A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d615e22-d8a3-4247-9082-170b85c47727.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8d615e22-d8a3-4247-9082-170b85c47727.tmp
Size 12KB
SHA256 04d0449ac40cf5c5eee739872accae024386eecfd0f06c4df9571ae7b8fede8f
MD5 631160ec21f30fb8811863a5f0477e99
SHA1 6a9ff86b05f29fe9ff083303905e0cd455ded665
SHA512 e78f046c28bc0c9304ef7849aa4d118b4a5ff1ed5b2b2e6caf8afcc6c6b8f3e3eb6884a2e4c74d3a0777bd8209f615ff52ccad13a2fea8f96ae494054f324532
SSDEEP 192:oREcBzp3S/Cv7EIAPRp2W1QB97Hsb+WNybf94BHA/92leppQjCrkw2HVyIsnAUge:oREmzpOO+XGVwimy2l+ymrWhe
TLSH
T1B642B42FED10BA7B9CEAD319FA65BB57D2F6202125842F84E6FC892C14E79DC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 202KB
SHA256 451e886db05bedbd9bdda4f1fdeb174885a585f93d52046feacc104cc87df170
MD5 2ffab6279dd7be55b816eec19a5de587
SHA1 e04a53a6011daafe1b8337bf59183a6eed2c5fc1
SHA512 51ee14687299bd5a15eded22dea62fb2bf124d88ac3183ac473b54e1efd872647000c43f7f2e3371f38e70d9f8a03eaa5589603e35457d1cc69e7cc79db36c68
SSDEEP 6144:FHqLt7oB1gWqS4wMX3k/IxuOX7uhRF+nd7QW:VqpoBqS/Mnk/2f77V
TLSH
T173142352433482D9B17F492C2FEC60B135EC9333E5532C46EA8B5BDBBAE90E3244965D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Size 76KB
SHA256 fbb62329de3913aee44f15d4c773363ddf88b3f1734f35d0ddb788d5fbde9c00
MD5 a80c228a4413528d58f32f7ba48f0402
SHA1 f69ee3b0eab9085826d1ca42ebebcacecb0dfe46
SHA512 62cb74d1abb59d0fc968ff35506e2b53343fc044d5f1d28a675e5e234f519a56cec0e9f727669c6e6638d5b589a0d3c01e480bd7f202fde551734d4dec62cb55
SSDEEP 1536:iEaxw/xtulAX3JXTiEopB46xQuZcQCd6j5qTaqrxF+ZfkzWGvJw:NNJtuWX3JjibBTxbb5qTxLwN
TLSH
T16E731233B7CE659281E46E6437054F6F2A1F10D13D3A79E7397028FC8DAD26CE51261A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Size 91KB
SHA256 c9cdba467ea80770df0b7e40144345b532ba3d0e1a87fd439a0439620d63ce02
MD5 9ee60c048965422f6b9bbc0ac807d933
SHA1 3cfcfbcf4a58060dcda9756131052c28fa98d0cb
SHA512 10ce86c7c91abe821fd7b7c1ebacafda21498189acf25a37bb94fc4cbaccdfcb4523efcbef8b2a52890111c10dfa6a0cfabcf862540f6e71dea783257035ca46
SSDEEP 1536:GvHmkJt9VsXYCN2hXWECMTZUC/jAnPDLIbdYGRZMDUAn2ihAGmMz15tLtd6:GfjJCYCYpsMNU4APgprZCJ2o/15F+
TLSH
T1A59312F9779AD648C56856853BF8BD2151B84F95FC833F04DEB5881CEA4F26EC881001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Size 550KB
SHA256 b6fd2d52b8f47308001efbb206463fa41cc77a749bd05928f3ee0b5fda537524
MD5 7e17d2ddc76f5f060289d5ab64e9bbba
SHA1 bd01e0dfcb1009f6b5467459928825ec31014a65
SHA512 023d940d092c62c8758dde986b1659095cf00b302684622447316037bc84f54e87891b61c2505fac14e189104a5862204f97288661ed6bd0b565e219907212a7
SSDEEP 12288:yaYT+sOf8DP8RSamMMe4Emlhtod8ifK0lONVd5y362:w4EDeB4Plh6WGhlOvHy3n
TLSH
T132C423B984C3BD1F58E10A5B661C6733ECB16DA007F81AB9C44D479F91D81BEE62318E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Size 65KB
SHA256 03a9ce9dc5f8dcdf2f866e2a4f04aeb2c89162e5f5596749cd294782281bacd1
MD5 26f3386a44f86e6b82658403cea49737
SHA1 a5cd94f8432ce7c8525aa67628871b3adb1dd9f9
SHA512 7c6504d08d02412f455f7301739cd4a3cadfed0e2c01ebcce67bd975e507b1a141701939ebb2b69bd8430f1730d3664febe5c809daf7924635887cbefcb2178b
SSDEEP 1536:D278JKue3bSGubitIB4IwmFBN6m6afq2Sc84T4+0NLxQSJrSdUNao:dJo3OGYit5IdjfeZWV0FuSVSdUUo
TLSH
T1C9630277F8FE49F7E399708122DA4E0A749C29471B71C347BEDDE2C053A921DE2A0592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d
Size 59KB
SHA256 b997c8f54f7402a72a1724710ae7e51c9b51aa8d3a06be5b69966a6b21734f36
MD5 a5f48366fb3a5ee94d32fedd95b1bdf6
SHA1 a003a0bfed6e50c5085f236e9f4eb28e313f59fa
SHA512 1e2e818e8860e951825d1a08d2fb595639769bfb43a0907a4f627bce1fb706d2bbd5d34f754832fac8d9287b4fbf4705ad88362ae97c452098a2dbfce51043ef
SSDEEP 1536:FKGqDswRW5t1kVq5mA+rgUB5QhZv2mVUeq0gbpJBXLo:EGqD51Vq1DUB5QhZv2muAujBbo
TLSH
T10C53028C02642D27BF944DEC60CA8D2F3D19ABB7925C9D2D5268FED37D8725E80B06D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 48KB
SHA256 1ecc004758d1f33f31f236cb749939373174f97a217e8ffe5cef5acc0788f34d
MD5 ae261fb223520fdf74b60dc724026eec
SHA1 c9fbd2ab11819eaf835e2210aa45157bb4ea3f97
SHA512 2f32045b4bb371a41d0ae6d15a3e44901dbafc2db518fac16dd550fdde8410472febf9b0e6d0886f6caec46b2c3e99c925ab735ac1d22183cbb29c12f1b507b1
SSDEEP 768:Th+upe/tQtN2nWKlyZazWFhj21NlgrKhW2/KL7qZrj1Cqqj3injSTrCzy:T4upe/uD2WKlRzuwNAjL7qZrjYjj3Ku
TLSH
T1D9230224A308A151AD1E3DCA9852F3A3F4E637FB4437722C6EA774238044F6E157A55F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f
Size 52KB
SHA256 62946697bc4a18cb973a4f1252fb39313ca4f7de06d95bd35c48d98adb3ac91e
MD5 829b1fbedfa315442ac1334b3278a40b
SHA1 21e64a0cbb4480a795f1e2fbd599151c6e502b1b
SHA512 03a39a1e410b5377d310ddf6f930b83ceaddac39543e09f8058246bbc1b340d86b73a2d43c9e9a42afc9f53b47f98ea2f425b195a0029c5b306f3ec09bcb8fb9
SSDEEP 768:+yMYSLe+5XS8F+OxQFVbSU7hV9BYUJ1NpVX1NzuLK58mOCEx7dEFoG7+ENDQPyMO:+yMYSLaMSHtXDY8Qx7dEFfDNcK/Wj0
TLSH
T13D33F2B074FFD89E1AFE5195450CB1F24C8305B16BDAD5649206FB6071EAAF864233F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 126KB
SHA256 46746310076e5021e6fd8aa5b1fd1b09ddc0f362102aefe5934044bb5210fdbf
MD5 784b9f70b87ccb8abe92eae38172bfca
SHA1 6378dc64c9a6c36882442b9086be6e20b20da264
SHA512 64920785038ef95ae4dea29cecb4de63a536bd45f9597dbff871583771f0a8d6c2838b8a27f4654f81ad2c95b96282cfa449963e41d9cda0e3e9fbef4b4d38e8
SSDEEP 3072:pdZa5s+3TmNKqcl5lUar88jvXIWxg/BlOkqGPE6:85s8yoqQ5WtY0/B3qiX
TLSH
T1B6C31263EEB0CF1F1040755B2D6DD1F41715221C6D21E0AE234FDEA90DE197A2A6A4FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 72KB
SHA256 e38b2892bcd7e491a7c7ae035451b90bfb8bbeb73af674665af7cc921a5d8662
MD5 4774810ad009e7a586343da1c94002a3
SHA1 e63c3b48d08b31959e91d88d6807a91b35a54d0c
SHA512 303b484fab7785d00319db7852587c587c5dbe4a96c4603bd6060a554aeef781ddb7a4e403c5240772ed2dae04e774e674ffca472a207e39d6a6fe4792200d9a
SSDEEP 1536:JlaM5/itP4gezyd4G3NgbKwNtscSYO3qOoT3mgd8mTD:faIqtP+2dXEKgscS5vil80
TLSH
T12E7302E5211027A4AE78E360ABA0617A8ED7511A4D0C0125C2E7368E5C95EF43FDEADF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Size 114KB
SHA256 5f38e69397670558792fd265b87ab6978d06d8ef6a81ad12d0889e2ffbe01843
MD5 35d8dedad876187761764c08b7302ad7
SHA1 5bd093b2b9a29c9fa13715b301d7859946387163
SHA512 fed60ba13325244986f2c39de7e1f2b6513902ba7f5b07f8e410732eb8ec35c1e188d3286e9b495bf68a60e8aab27273dadb5a2e09d7a5f710a2b07995f6b449
SSDEEP 3072:8bsNHiGYUz8zWljkQKKzLXU4Y947xd/5pwcvL1:cskGX8kjkEtYSpMcB
TLSH
T13CB3124B229A45E7226D1A771B56F920BFB8BC59E23B574303E47A9CF47C844ECB7002
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Size 27KB
SHA256 78f32ec4a43b3b142ddaf7283d0561bb30d2288fad722e0973c5fe5e920c839d
MD5 621d1db66a87c4217aadd8bb7b7418c3
SHA1 cc7526d6caa99a0e95b19cb5ee5a68830b7e11f7
SHA512 4560c8d259785f7eea28cfb08ae5c275851853a6887d01266b00c087bcd5bc657afb300588433b5bddcbd33ba45f679270085316352e9ed1f4e4c78704a2adaf
SSDEEP 384:vcDV2oLldTd/8KS2I9iXzOeqGbg7sxlNARgnVfCnUUS/OqEUMCgt65XSH19RXo1g:2Uox4d2rXFZbgWGg8UT/3Ez61Wn218h
TLSH
T11BC2E010AF4E633A0F8EC2DB694764A7B8CB68725B7C8F603E2D7BC84515196F518C03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000014

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Size 433KB
SHA256 d822d71d40933e7c0e95daed229d6e5a2ed429037d0ca2ddd539b2aafc227888
MD5 489a0d2d52c9861415ac3d334e8ec7b9
SHA1 e4636d7a5b84f63d10da6ea0b08c339e1b4f9662
SHA512 94be5dede95e16f50110c0afe4383785ef7977f97124899f40a0b33fdd3044e9eaab56c239c91aa3c55e3ffe18ae6e800a7d58a40a70a8c106029c7ddcf2872a
SSDEEP 12288:SdndOAEo11u9ToRec6EuulVsVBj+4q7mk/w:KAAEIgT3c6Eu4VsTqSkI
TLSH
T17D94232DBFFB932409A9712E1F020C8796C0E79DD8965EF2279900DCF51B68C59E38A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Size 126KB
SHA256 0463d83d6966ab5d25bf311467aaf0395318e0fdb30569040db34abf96af8561
MD5 5e377bbaf6d270295d4732eda409e118
SHA1 3afca9a00049d9453725271de58822a9e0c3590c
SHA512 2e46c4f0ad1a20d4a1dcc220705a0568f8f01f129abeff05cce2204d07d480e8524d9a5ed794333fc42032df6203715a57684ccb0bcb9c8368730102058d0fa5
SSDEEP 3072:TtJEIVZBxeIeOHR1CPNmVXRAxA3AkrqqFRrMGuIRjR:TtJEIV4IzVBn3Jrqqp/P
TLSH
T141C312B5F33103F00445455AE43150AA07AFDE26BF2D5E7FD87B3188A6E6EC76C58280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016
Size 163KB
SHA256 7238b1a1e53b59b639b2a658399d54e76b50a17ed23ba243123f0d5fcc1ba73e
MD5 35c17f13bdf2bcb71006ba0c9c3f671f
SHA1 c6d49307b324985b6a414f573e05baaedf6b5861
SHA512 4469a6375cc962e928f70250923fc28de31cea37b8497eae7c0ca9a36d752708a644282afca6e0849660676a9e4eb9382c119a0e7395daf1e51e1909b5e85da0
SSDEEP 3072:d7hpal09SmJF+30ZlF5mHHuLJAmsqs++s8clREjJ7Y2h9HDN4LtvFIJDDUQq3kAF:dLf9SyF40ZlFuHuLJAmPKclRy7YiDI9n
TLSH
T180F312980CD3D164BED488E098D2ACE4F9F84A2EE647F062268F433336CD5DA649571F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000017

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Size 334KB
SHA256 9ace796d53c33471d82819d048b7bc1f320402dbb632915b2e6304fb878609fc
MD5 9ed74913668d3f30f69effb69d77b99e
SHA1 cf82d08a7e46d1329d1134b85524d9763a016acb
SHA512 dc496098667c6194bca2471351ea54aab7c60f0149a1e5f4fd6d72d6b43f0d4102e016b8b385d29d1f33b48edb5480c4dbf265e8b77ec2c975f23b7140fbb27b
SSDEEP 6144:QDYmgqNx1JDPX3J1waPOjLRTOb+yTLidzVCzIxUrzommkRffTuMSlxk46s:i3bdJmFHRab+yTPIcUqNTurm4/
TLSH
T1067423035C4309AB669C8699F6D9CD2BF7C3669B45A6066338809803FD3C74E60836EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000018

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018
Size 98KB
SHA256 f2b378cfa420f891d46872c928cbbf17dd0f384652345e5c18629b96284ad1bb
MD5 29a463abf1a94380e0b0748f1a7c28d9
SHA1 ba3ecf3e356d6dcf87be4d986adbc7191e2edf2d
SHA512 86a504308d33177291ac9e7ede45327070822ad4e1543e525267498e20ac57104fb4c1395bd8cc9b14960d89d0e176842931321680bdcde088399e60c432b6d9
SSDEEP 3072:HGpwYPcX0HLL1FYBvITHep9pYbcnDZc5tBvI:PY0kl6BwT+XyYDZyBvI
TLSH
T1EFA3024CB5721E16FDA02C71879E12CC488F78A68A6D2DE4B1425CDC9A4A6FF441EF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 744B
SHA256 aca960dc2945d93c3e472657f717105157a91efc6cccff1ae7074435ce4f94a3
MD5 d6564b8872d250b509e4278a7177faff
SHA1 3ed2755455d400dc1571997ca5e2bcaa3f4c4c52
SHA512 430bdd96e5fbb918a3692210c1ff63f1eb3a54a0816a94bcb584448696e8210c0d6cd7a5574002aa4435ee7251e4914c8e4691198e2339817ecebb6fefa9484a
TLSH
T1B20146D12182D1D2DF88367870E6C998C5CB18CDCB100605908926B8ECFEBB2138B09C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 54b488f876e29194c694a5e00187cfd3cd58a19fb59f832af6b21dd9f19a80c8
MD5 b031d0db4ec88beae8a330340528943a
SHA1 6ea0c61409cf9aa75a237888a20af8f06d67a984
SHA512 5c9c8439c0d76654b8aac046172c906712f9fef494fe3ea5301743e48077c660f4c8bf55618df8a0081847f60c7275d49ca7005323355b66b725d05e39d08765
TLSH
T17D5171C826C3D4F8DF6233757CF2A14E09CA496ECF4D2A855244A538FDE2B312643878
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0989d55f-6070-443c-874e-b5dd50b81a7e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\0989d55f-6070-443c-874e-b5dd50b81a7e.tmp
Size 6KB
SHA256 01b5acc52df3b28b4fb351c3988cf7e0ea21670a04dee865a1ea095e504527d3
MD5 aad0a3b364d53604e534dc919972f8fd
SHA1 ad044344cb0c63a5ec68d4bdea6bc45e9171d367
SHA512 f27c9832b22993f78ce36bf3eb440142b668007cb69517e27b2609e5339468f26b28bf4ad4cfb95e5d85a955cffd2bf51458a4700bc81156b989b8693204a8be
SSDEEP 192:DaiJl7Ekj9Icp3a2zvlpYLcNAoXSxhXfQ8gYVE:DaiJl7Ekj9Icp3actCLcuoXeho8gYVE
TLSH
T1FED19CF7C3E8862DD91166F49B11AE1FCE291A18531C3C26C8D9AE1BA3F3871D25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24fe0a57-5d26-4ac0-967f-68897716a413.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\24fe0a57-5d26-4ac0-967f-68897716a413.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

554cb138-f85d-4745-a7b1-fe539ab161af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\554cb138-f85d-4745-a7b1-fe539ab161af.tmp
Size 12KB
SHA256 919ae2553405bbf2a7458c88dd65582585c01dbb23096683ce510d3ce36a2814
MD5 e1dcf03fe58c72ebc2925e1d1b41a7c4
SHA1 781ba8de49640bff8a600d85f5fbc2925169ce2a
SHA512 b4399dd3a2de30b0b56db05b095dddaded3e47ea628844b0956a43b5bbba24f043f9fbbcedcbf46f1ecc64e9952cf38b90800469f52e568834d4e4b9eed7d46f
SSDEEP 384:DaiJl7EkjlMwxQJV1Mzy9eqJ8R1Icp3acScuoSGZ1azYzSlJ6DDrn1le/1f5N/Ic:SvjFScrwQbPH
TLSH
T11B428CB7C7D8852DC91166F89B25BF1FCE191A28432C3C26C8D8AF4B93E2871D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69f03ff89d6df0ee_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\69f03ff89d6df0ee_0
Size 1023KB
SHA256 b94c85cf4fba19d83e2c33fb66db86e352fdad4bff4d5f2c3d18f54649f1e091
MD5 e29c81e73f67ccd7c0ef4a0d8e63a214
SHA1 cbd240a97439a484414fdba84635525d96f05dbd
SHA512 c85b86c090e2799eebd92b58fdda74214cde756ea4814e1c3dcb682fe087abd1e9950a01615e7c444d888c6d0a9e4df3e5c2bb6bddfec4c52366a182f2c585c1
SSDEEP 24576:t5jPxGPIdvQK+OTz3kXlOGURooelw+J6/ve:t58wdvQK+gkVOGURooelw+J6/v
TLSH
T19C253BD873A3B46362B1F195416F428BB3AEB892F049886CB5A8DCD12DB4C5541F7F38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac9add9698fab2e3_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\ac9add9698fab2e3_0
Size 511KB
SHA256 8046a37cadb239a1126d4e35a7a60fc730b8ce801b634fb0abed5dfd6a95a710
MD5 f29c68beafb9a4d37bd8863cd2fd06ff
SHA1 a595a4f4818c6c350eef961c835345c501697c26
SHA512 d8dc50cfe2a8125c0c491eb15f9423e5852bd0f1fe54ec6ff0ea00f0e62e74f80acc7183070125a913718cf3cf2c0a40e2c49ea1bce9e6dbcaf4474d704a5abd
SSDEEP 6144:4FdrHT4nOIyeHGalIyS5UYEYfWmNmO01nZccvuExI74S/P:Sz4/yt0CBEYuhO03lvtxT
TLSH
T1B1B45A7063326EB7CC1F66D1AAA4A74D785FE337C96107F895E28A7097C68B1780724C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1780710631cfcc4_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\c1780710631cfcc4_0
Size 255KB
SHA256 4517504381f20d2ed914e48f60f12f42bdeb663512f0731e36f6cf541e674fef
MD5 b0973dca0e7b25014a0ff981137cebed
SHA1 e461f9878496517d0873bc61c2f028957cba71b8
SHA512 736338895797f1fb3d5dea48e9f4f2466c41f793a28aad8d572d49aff12772d96186e1b5c03372a283a96614e4e9cbcec7d5fc8b9b6e71e230230162bedaaa60
SSDEEP 6144:coQBkpJZ5CLXmkTGGrHA/61/5s1WcE+m88IZ+ga97R0mpK8R/I3wK1Xey:coQBkpJZYrm9LE+m88M+l7R06K89I3wc
TLSH
T18F446D723300F13FA8278EA5A6BE7F4E3825E217DD1705B8D6E4E4358FD5EB91412688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 120B
SHA256 5c5fd200236630ee8005fc553d3c7dd03a4d53ce6f6991fe99c1c52d6151068b
MD5 d363a650fa27151bcc624fb9b4aba14a
SHA1 d93a26a9782d82c79788ad1a921e158e626cb2a1
SHA512 49ba3090c3bb807add266474a0aa7af2290f827b18163da694850e994befe15156e096a23f2098344e93d735397cb26fc9fd5f84fb187effcf4a494fa62fb9da
TLSH
T1D4B012E821D416A1C4140B318BDA14C87240BD2057156657C2611018C5810434A3516E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 144B
SHA256 502bf58757c4925cd6151fd3afba2a39d7570de0b40ff19930f7b05303fc1fa4
MD5 d4dcd66a1f0cbc10c40edf9ed66cad21
SHA1 021064e18ff713d987f3c32b36fd8d50cfacd7bb
SHA512 38ce701d4257731ad1cfc3c63eb6cecd9252afb9f33eca7ae2bdb786d08c21aeedff23fff33856f2c2c726039dc90db6d6205a6cb4fc21d00718c99cf38cd433
TLSH
T1FCC012DC374532D2C80197318FF7918CB3507FA9B713A929C252305CDED054B491764D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 532a24e21e7e7f35df081c32918141409972028e729c4ccf1489cac58f0471b2
MD5 5d664f84d6f4a5fa86465168e6309dfe
SHA1 8c48b387bb7f9b1d7be03e9df81c5a67c250b068
SHA512 87fd62fae2db65eeaad967e4a4b20026815bacae84d7278d4476c031a60dfb04f9228e2614805bc75461b8a5d86aff4c453250cf05a4430babfac128470e388a
TLSH
T1B8A0025545D5EC52CD71437071F14A4272A149341A51834B589504B5DC9B6C19212101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 20b951d7e6129cc6aacbea6a7ac226c21f1b15031517e48fd9d8af8879430f60
MD5 26029c5d1eab1f4cbcf59b38835ae56e
SHA1 436c2fd7b061906c86d054459c57d2956e6fab01
SHA512 8d72dac5b1a26ca4cca9f0bf9df1d1f0e674e5350118b514be2fcbf7c4f1bcc139fc7eeed220c83152b143d05551c15d7cf242635de17077b97bde833653d743
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\6d3ff394-1520-4a6d-97f6-11998ae5027d\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 157B
SHA256 7abf2d6f485544e2f6a71f23ad316a0e704a1f3886046569052d73c13d2c1abc
MD5 cd91185a57b81c298d2787bd1cd36924
SHA1 205261ccd90eaa19bb0083c1ed108a80eabad512
SHA512 4f350b6120c0241f6d4f86acf31c47f5459a678ee2b84e7a68428f64e9ab1774728613684858b9c79731f9479cb9fd5c9ef36db8dd509934eb114b969d6b345f
TLSH
T1F4C04CF3152489CB4B71A6D85138766DD96B8E4E4CC8CCF8D45971822175A234405A79
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\2\CacheStorage\index.txt.tmp
Size 150B
SHA256 3a9c2bab2efae73e18663045092cc1b2a1dc352de0ce53b59468414aa64c2ecb
MD5 990cfd8a821f6e9b769c131307a010a8
SHA1 c8e21ce9a769c06c9eeb88b330e446a44c3b9dc8
SHA512 5585954685f8401ab8a3128b421fa535790f855bd8b94db77ea3444d00c6ccea45918a427b697398c39f5f08205e7fd280fc95f7ae3c04dd33789f420c4049b2
TLSH
T15DC04CF3151489CB4B74AAD81138762DD5978B4E4CC8CCF8D55851822575A234401979
MD5 SHA1 SHA512 TLSH

Submit Download

ccd893ea-c86d-4e1e-86c2-20f1e2e21041.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ccd893ea-c86d-4e1e-86c2-20f1e2e21041.tmp
Size 13KB
SHA256 c7defeaec5edc2c8fc48ca00d09ff757783ee25b50561efaf609a01452267ef9
MD5 5d1d5c8f8c836e4b8c80a096e76ab760
SHA1 b13c604f14b278f3a2268bebb8397bd1032077e6
SHA512 dcf55b4077a192463a9c44f9ec7db94c778275d93b32b70a233223432da651a10b63b47d53134ff3debb6118749a407082cf813aedd89a9f6c894ec8a6909796
SSDEEP 192:oREcBzs3S/uv72IkPRpVW8OB97Hsb+WNy4lf949c44Q1opeppQjCrkw2a8yIsnAI:oREmzsOKcXcVwxpOop+ymrW9E
TLSH
T13952C52BED10797B9CEAD319FA65BB53D2F6202165D02F84E6FC892C14E7ADC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ea0d2209-47f6-4da0-af89-434b9e34b813.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ea0d2209-47f6-4da0-af89-434b9e34b813.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

eb2fe7db-8e21-4d77-a4a3-a82eebd89169.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\eb2fe7db-8e21-4d77-a4a3-a82eebd89169.tmp
Size 13KB
SHA256 af5b8742bf1e45f205add7389d9b06d944137a662008a005f57a74494f447255
MD5 db8baae34eb4d9f6ff2fa9544df52d26
SHA1 066295f1dbcee103dc297eb51994630ebd3d89f6
SHA512 fcfea28f760b1598d70e521a6a39d897e59a6dd6906021c8d3f6aaf0718b2d840bc7b4132c5bba6aa6f0cd7e36db01bea5e4e66b9c49f4ff9760890c88e79e6a
SSDEEP 192:oREcBzs3S/Tv72IkPRpVW8OB97Hsb+WNy4lf94BHA4Q1oZeppQjCrkw2aVyIsnAI:oREmzsOrcXcVwxm2oZ+ymrWaE
TLSH
T19152B42BED10B97B9CEAD319F965BB53D2F6202165D02F84E6FC892C15E7ADC2117013
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faa39e65-5a95-4e9e-8863-884ae580402b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\faa39e65-5a95-4e9e-8863-884ae580402b.tmp
Size 12KB
SHA256 e3d1200de3f10d127fab8a371d5c8448feb5b2a022665171e37911eb291f6bc4
MD5 3d153c5464fec0eb27335386c869bd1e
SHA1 3843687e89d7d769012f4964397586c73230c5f7
SHA512 eae2e78b7bed6e1612bc28e2e74259de86501315a9991deb5135feb3c44efc72ef2a5116ce2f3a7514539c5a65c2efefb7e3fbf4880987e6553eaa1aa62c6359
SSDEEP 192:oREcBzs3S/Tv7EIAPRp2W1QB97Hsb+WNybf94BHA/921eppQjCrkw2HVyIsnAUge:oREmzsOr+XGVwimy21+ymrWhe
TLSH
T19242B42FED10B97B9CEAD319F965BB53E2F6102161842F84E6FC892C14E79DC2117017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d226ea73-eb09-49a8-90eb-683a5632a2c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d226ea73-eb09-49a8-90eb-683a5632a2c6.tmp
Size 4KB
SHA256 aaa398bdaf632066d33b780b459bb31f3bc1ae47bfb4d6f23d4958992cd863dc
MD5 be8ba23eb29b639571e19efb315d31de
SHA1 d132fe8dcf5485967c36dd80a61995c94c073155
SHA512 869bd86d371c4d86ca0b655fb0eda715e008ff87252d00ae789615cdcd1a9fca8b20e8c020ef78dd6c284ab2c9f11ace2fde93dab478686cb053fd639fbdc11e
SSDEEP 96:eIlC0d+pK242KafJf1OIu5fksRDotok5AsDZB6qpGyv+7hhL0bZv4a:ZlC0bt8OI8lDUDF/PUhhhL0bV
TLSH
T1D7A11971E96C99B728B6C580B6462F43DFB872676162DFC4DCDD1A1D20E71F80382613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d8dab47e-5ed1-42d6-ab99-13a01f17bbca.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d8dab47e-5ed1-42d6-ab99-13a01f17bbca.tmp
Size 143KB
SHA256 f9a7a7d51436391c9f35443d58c400186cebc2e0ffdf3fab43a62969fbdcac82
MD5 c37fc2835132b8c49266cfd0f7e8ee08
SHA1 9cac795c98bb2a116907ade4fbb23e51953657d1
SHA512 81f597755e6fc029212ed12a5cbb4d322438b93053f61f0ab55703e8e5c34174a37224cb0cc63b1489ca25cb7307eba8cf2181c6e4bbdfaeb1051c7820f7c466
SSDEEP 3072:6iBSIgHOmcvuRYKScVjFRbK26vzilq+1xjU9//LqO:65LufuPSCbCbJ8xU9/d
TLSH
T129E312B0696DFA4F7112146A733F0A539F2C9AC7C84595CA7E8790E6638FC98F603C85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 63KB
SHA256 787aa37ba3c2506b6242764c1a6353b972e6b58c2a23f2e5ee9949adc49840cd
MD5 e2051d119df5cbe46c6e6442eb977db7
SHA1 2ed18a142da3486ccb92ffc6697b77450191399a
SHA512 e1d95347c95f3f03522568aed8b8d9be3fcb1af443dfeeab128d31adff338142e524a6390513843df08b731931dcf8bcd3ac8970baee02e5ec59ff787ff947ff
SSDEEP 1536:EAxpYoDzC7MXfKQH3flJnoeYXh4iUx7aT/JK4v85OdBVV3CNBQkj21aVLklz+z3N:E6pYoDzC7MXfKQH3flJnXYXqiUOrJK4o
TLSH
T1D55384D3E9204E75E1A66F3EF15622627C34394690F8113212DC25AFA9879930B1F7FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 0722e2e2cc03e08f94a90284c28d63278b26224d7a4b0698c04908ef80f39048
MD5 359dc6f2b5f509ba2a7201f2ad0f8441
SHA1 20384073f6f66e2f583841a150451680e83c613c
SHA512 459fae512565eed73961b2f3873e910899c7f53fdcca2aaf7e6b1d7bdb50bd201516e77d131481bc341d2ba46aa07ca3724505d81ce8e7c3e65fdb55f4bbb051
SSDEEP 384:H1eBa1ss1iBfGW14bZzzK+5h0tznr2xqNIArlZg5F4PstF35SOWQ06bhNbUpmRIR:VeEsk6uWi1zm+z+6CIArTo8snrJbhNby
TLSH
T17A92B568213F6DC7D8D6117414D602E7FBE0E489EA766094FE2BDA2F5C90EBB4F60520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0ygpymsw.1kt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0ygpymsw.1kt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ee317740-ea56-4e2a-ab0c-0686bdb3f914.tmp

Path C:\Users\Admin\AppData\Local\Temp\ee317740-ea56-4e2a-ab0c-0686bdb3f914.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python-installer.exe

Path C:\Users\Admin\AppData\Local\Temp\python-installer.exe
Size 52KB
SHA256 01c455abc37f9e156e381bb56d0f5114038360a98c89b425a606529fbee4f173
MD5 9632ac84749ec5f91a0b1d0f1400ab32
SHA1 f12fe5b6bad02e6aaec30af293a36308ef14b37c
SHA512 c9fbf5adf0326eab452757206fef0aa53ba10a9c5cf96524a7ee196316c67916462165d59bb12248699a60b7b7be22cb9c3a4101d647731111034c48269014c2
SSDEEP 768:kbIwn36lC9F+O0FiPugU7ePoBGhJwrsb2Y0sppmIS:sfn36lIF+OgQug4ePoBGharsyYXnmIS
TLSH
T1673331A390F73433066396DE29A92738F4D3406FC2892E0535FC5A689FA4E71BD5364E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1424_1380792309\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

YZ7GNRUA6WAC37B3N0JY.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YZ7GNRUA6WAC37B3N0JY.temp
Size 5KB
SHA256 4c9482965f28201252b042d7e181c9c3740e19cee9a8af18412c3bd38066d5fd
MD5 f013f4c508992581cf18b5a3018ba50f
SHA1 525d686759de77b2ffbca880074f168b1ad54b06
SHA512 f01b6245fc6a8a9d364fddfb5c1a4c47e4387c6e41ada9e1d9be36201cf2402183c3dc3317d52f27786393c2be856757402ced640f23f205d8f0027e87f795f7
SSDEEP 48:DfZKknCmYUNQJFnukvEwoFpXpFdHn94aBJhSogZogm69Hn94aBJhSogZogmuD:TYknCswFukvR+9Zd4gQHnd4gQHl
TLSH
T1B0B1B00023F20A1AF5F64F3A68B6B721A235BD44DF069BCF5380655DAC34625E539B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 5KB
SHA256 1cc8329d77923c47831b0fcbc7c7da1e015ff2727408977dbfd42249b1f4a885
MD5 5b0dc59f80950bfb3e4fdbdeaeb3479b
SHA1 f92381e10aa0820c8cb454c5a33640f348bd3fe7
SHA512 f405cdab60f6314274205ef4d872730f0bc4198f2ed792f7b2bfd41936422b24ce753622634404d64a2518cd0bd83251d266b1528a04d3a906cff16aa183ddaa
SSDEEP 48:AFuZKknCmYUNSJFnukvEwoFpXpFdHn94a1JhSogZogm69Hn94aBJhSogZogmuD:AgYknCsmFukvR+9Zd48QHnd4gQHl
TLSH
T1DFB1A10023F20A1AF5F64F3A68B6B721A235BD44DF069BCF5380655DAC34615E535B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fee1694d-57fb-4a8c-8083-a30a0ca514a4.tmp

Path C:\Users\Admin\Downloads\fee1694d-57fb-4a8c-8083-a30a0ca514a4.tmp
Size 15KB
SHA256 1cf8da5943868e970e9a0260fc56077325c686cb098828c678c03e1472c12c7d
MD5 bd56ce0a59130e69850f8d815ad5374f
SHA1 5dddd787eca5f41c8566953104d6733d4518c464
SHA512 160b2b9fcf5325d02f59b3ba7517537823dcd70df5333cd996ca177413dae6ec046a32e49c862c491a56c75fddebfcce341e0b986a7607dfbde4a4f5823a4f0f
SSDEEP 384:QRTdanjFtNp2r1d/ec/UUsXOb5bWEjU943RZ9:+ERERd/WUeOb5iElr9
TLSH
T11072D14781FF6030CF19EA36F01FA4956F6F7AB85B1E18B935024008547F7A4639AED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-1196-0x0000000006260000-0x00000000065BB000-memory.dmp

Download

memory/2416-1202-0x0000000006D10000-0x0000000006D5C000-memory.dmp

Download

memory/4380-56-0x0000000007DA0000-0x0000000007DB0000-memory.dmp

Download

memory/4380-1162-0x0000000008EF0000-0x00000000094AA000-memory.dmp

Download

memory/4380-38-0x00000000067F0000-0x000000000680E000-memory.dmp

Download

memory/4380-37-0x0000000006300000-0x000000000665B000-memory.dmp

Download

memory/4380-40-0x0000000007A00000-0x0000000007A36000-memory.dmp

Download

memory/4380-30-0x0000000005C30000-0x0000000005C96000-memory.dmp

Download

memory/4380-29-0x0000000005BC0000-0x0000000005C26000-memory.dmp

Download

memory/4380-28-0x0000000005B20000-0x0000000005B42000-memory.dmp

Download

memory/4380-27-0x0000000005CB0000-0x00000000062FA000-memory.dmp

Download

memory/4380-26-0x0000000005530000-0x0000000005566000-memory.dmp

Download

memory/4380-59-0x0000000007DE0000-0x0000000007DE8000-memory.dmp

Download

memory/4380-41-0x00000000701E0000-0x000000007022C000-memory.dmp

Download

memory/4380-58-0x0000000007DF0000-0x0000000007E0C000-memory.dmp

Download

memory/4380-57-0x0000000007DB0000-0x0000000007DC5000-memory.dmp

Download

memory/4380-55-0x0000000007D80000-0x0000000007D91000-memory.dmp

Download

memory/4380-42-0x0000000070340000-0x000000007069B000-memory.dmp

Download

memory/4380-54-0x0000000007E20000-0x0000000007EB6000-memory.dmp

Download

memory/4380-53-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

Download

memory/4380-49-0x00000000079E0000-0x0000000007A00000-memory.dmp

Download

memory/4380-50-0x0000000007A40000-0x0000000007AE3000-memory.dmp

Download

memory/4380-51-0x00000000081B0000-0x000000000882C000-memory.dmp

Download

memory/4380-39-0x0000000006830000-0x000000000687C000-memory.dmp

Download

memory/4380-52-0x0000000007B70000-0x0000000007B8A000-memory.dmp

Download

memory/4380-1158-0x00000000080D0000-0x00000000080F2000-memory.dmp

Download

memory/4892-4-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download

memory/4892-3-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download

memory/4892-6-0x00007FFD37430000-0x00007FFD37440000-memory.dmp

Download

memory/4892-5-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download

memory/4892-2-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download

memory/4892-7-0x00007FFD37430000-0x00007FFD37440000-memory.dmp

Download

memory/4892-19-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download

memory/4892-22-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download

memory/4892-21-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download

memory/4892-20-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download

memory/4892-1-0x00007FFD39840000-0x00007FFD39850000-memory.dmp

Download