acrstealer | bf8f18252a4dd258361eb904d847af6eef5910b781bb212edf6f3d52c64eca77

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.cmd
Size 4.9MB
Sample261029-rfp2cszye1
SHA256 bf8f18252a4dd258361eb904d847af6eef5910b781bb212edf6f3d52c64eca77
MD5 9d07cf23e7ba002771c9b098b123a573
SHA1 bff5b39428ab9bf2a942c4db62d564674a7ce3d4
SHA512 f49458095639a60cfad5a6f5c4c86b419cf1e64889643cf4490ad947a625aa7fddb2ffd2b46c9332d6e857501d72ef86a10f98379592c5b347ecd3d2682e8055
SSDEEP 49152:1tG8M9mKjgALPWgPBXGsE6dogRP8Q1PRYa5wHoen3YELudIKjiv9GsNzyuywH:d
TLSH
T1A136233CCE4D2BEE4621A6F9F616B944BDCD23870E820307836CF66535E54B49A63C76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution acrstealer hijackloader loader privilege_escalation spyware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\vpn_stream_arm
inject_dll
%windir%\SysWOW64\ieframe.dll

xor.hex

Extracted

Family

acrstealer

Version

4.5.3-alpha1

vlan.nodepull.cc

Decoy

googletagmanager.com

Attributes

guids
a6cdcc0b-6b38-49d6-9672-20be114d9eba

01a17988-c4b6-771b-a789-4491523b4cf6
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.2.6187.130 Safari/537.36

xor.hex

Signatures

Family: ACR stealer,GrMsk
ACR stealer (aka GrMsk stealer) is an infostealer written in C++.
stealer acrstealer
Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
loader hijackloader

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ea-33.dat	family_hijackloader

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 1308 created 828	1308	FusioRouter.exe	81

Executes dropped EXE 2 IoCs

pid	Process
1104	UniSolar.exe
2728	UniSolar.exe

Loads dropped DLL 5 IoCs

pid	Process
1104	UniSolar.exe
1104	UniSolar.exe
2728	UniSolar.exe
2728	UniSolar.exe
1308	FusioRouter.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2300	certutil.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2728 set thread context of 1308	2728	UniSolar.exe	96

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFADF057E6B88A8EC.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{72E4F057-E604-43A4-BE7F-293D58F2BF87}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2BF8.tmp	msiexec.exe
File created	C:\Windows\Installer\e5929f8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9B2692193A5458E4.TMP	msiexec.exe
File created	C:\Windows\Installer\e5929f4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4B9ABBEB7807ECEE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF53D11E7CAA2E214B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5929f4.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5440	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FusioRouter.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UniSolar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UniSolar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FusioRouter.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4092	msiexec.exe
4092	msiexec.exe
2728	UniSolar.exe
2728	UniSolar.exe
2728	UniSolar.exe
2728	UniSolar.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe
1308	FusioRouter.exe

Suspicious behavior: MapViewOfSection 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2728	UniSolar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6100	msiexec.exe
Token: SeSecurityPrivilege	4092	msiexec.exe
Token: SeCreateTokenPrivilege	6100	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6100	msiexec.exe
Token: SeLockMemoryPrivilege	6100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6100	msiexec.exe
Token: SeMachineAccountPrivilege	6100	msiexec.exe
Token: SeTcbPrivilege	6100	msiexec.exe
Token: SeSecurityPrivilege	6100	msiexec.exe
Token: SeTakeOwnershipPrivilege	6100	msiexec.exe
Token: SeLoadDriverPrivilege	6100	msiexec.exe
Token: SeSystemProfilePrivilege	6100	msiexec.exe
Token: SeSystemtimePrivilege	6100	msiexec.exe
Token: SeProfSingleProcessPrivilege	6100	msiexec.exe
Token: SeIncBasePriorityPrivilege	6100	msiexec.exe
Token: SeCreatePagefilePrivilege	6100	msiexec.exe
Token: SeCreatePermanentPrivilege	6100	msiexec.exe
Token: SeBackupPrivilege	6100	msiexec.exe
Token: SeRestorePrivilege	6100	msiexec.exe
Token: SeShutdownPrivilege	6100	msiexec.exe
Token: SeDebugPrivilege	6100	msiexec.exe
Token: SeAuditPrivilege	6100	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6100	msiexec.exe
Token: SeChangeNotifyPrivilege	6100	msiexec.exe
Token: SeRemoteShutdownPrivilege	6100	msiexec.exe
Token: SeUndockPrivilege	6100	msiexec.exe
Token: SeSyncAgentPrivilege	6100	msiexec.exe
Token: SeEnableDelegationPrivilege	6100	msiexec.exe
Token: SeManageVolumePrivilege	6100	msiexec.exe
Token: SeImpersonatePrivilege	6100	msiexec.exe
Token: SeCreateGlobalPrivilege	6100	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe
Token: SeRestorePrivilege	4092	msiexec.exe
Token: SeTakeOwnershipPrivilege	4092	msiexec.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe
6128	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6100	msiexec.exe
4092	msiexec.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 5440 wrote to memory of 2300	5440	cmd.exe	90
PID 5440 wrote to memory of 6100	5440	cmd.exe	91
PID 4092 wrote to memory of 1104	4092	msiexec.exe	93
PID 1104 wrote to memory of 2728	1104	UniSolar.exe	94
PID 2728 wrote to memory of 1308	2728	UniSolar.exe	96
PID 2728 wrote to memory of 1308	2728	UniSolar.exe	96
PID 1308 wrote to memory of 6128	1308	FusioRouter.exe	97
PID 6128 wrote to memory of 5364	6128	chrome.exe	98
PID 6128 wrote to memory of 4712	6128	chrome.exe	99
PID 6128 wrote to memory of 1544	6128	chrome.exe	100
PID 6128 wrote to memory of 1544	6128	chrome.exe	100
PID 6128 wrote to memory of 3396	6128	chrome.exe	101
PID 6128 wrote to memory of 3396	6128	chrome.exe	101
PID 6128 wrote to memory of 3496	6128	chrome.exe	102
PID 6128 wrote to memory of 3496	6128	chrome.exe	102
PID 6128 wrote to memory of 1240	6128	chrome.exe	103
PID 6128 wrote to memory of 1240	6128	chrome.exe	103
PID 6128 wrote to memory of 3380	6128	chrome.exe	105
PID 6128 wrote to memory of 3380	6128	chrome.exe	105
PID 6128 wrote to memory of 3032	6128	chrome.exe	106
PID 6128 wrote to memory of 2552	6128	chrome.exe	107
PID 6128 wrote to memory of 2020	6128	chrome.exe	108
PID 6128 wrote to memory of 2552	6128	chrome.exe	107
PID 6128 wrote to memory of 2020	6128	chrome.exe	108
PID 6128 wrote to memory of 4216	6128	chrome.exe	111
PID 6128 wrote to memory of 3048	6128	chrome.exe	112
PID 6128 wrote to memory of 4216	6128	chrome.exe	111
PID 6128 wrote to memory of 4720	6128	chrome.exe	113
PID 6128 wrote to memory of 3048	6128	chrome.exe	112
PID 6128 wrote to memory of 4720	6128	chrome.exe	113
PID 6128 wrote to memory of 5984	6128	chrome.exe	115
PID 6128 wrote to memory of 5984	6128	chrome.exe	115
PID 6128 wrote to memory of 760	6128	chrome.exe	116
PID 6128 wrote to memory of 760	6128	chrome.exe	116
PID 6128 wrote to memory of 1828	6128	chrome.exe	117
PID 6128 wrote to memory of 2320	6128	chrome.exe	118
PID 6128 wrote to memory of 4548	6128	chrome.exe	119
PID 6128 wrote to memory of 1828	6128	chrome.exe	117
PID 6128 wrote to memory of 2320	6128	chrome.exe	118
PID 6128 wrote to memory of 4548	6128	chrome.exe	119
PID 6128 wrote to memory of 5092	6128	chrome.exe	120
PID 6128 wrote to memory of 5092	6128	chrome.exe	120
PID 6128 wrote to memory of 3376	6128	chrome.exe	121
PID 6128 wrote to memory of 3376	6128	chrome.exe	121
PID 6128 wrote to memory of 5064	6128	chrome.exe	122
PID 6128 wrote to memory of 5064	6128	chrome.exe	122
PID 6128 wrote to memory of 3640	6128	chrome.exe	123
PID 6128 wrote to memory of 3424	6128	chrome.exe	124
PID 6128 wrote to memory of 2012	6128	chrome.exe	125

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\setup.cmd"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\system32\certutil.exe
    certutil -decode -f "C:\Users\Admin\AppData\Local\Temp\setup.cmd" "C:\Users\Admin\AppData\Local\Temp\~940533d4.msi"
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2300
- - C:\Windows\system32\msiexec.exe
    msiexec /i "C:\Users\Admin\AppData\Local\Temp\~940533d4.msi" /qn /norestart
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:6100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check about:blank
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb2f00c728,0x7ffb2f00c734,0x7ffb2f00c740
    3⤵
    PID:5364
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1904,i,12450486381906642599,11129358792788816833,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,7983439863552579962,13753348369517040953,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
    3⤵
    PID:1544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,14225243752405659455,13339020741318410590,262144 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:3396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,4315118031868538698,17601708968312279054,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:3496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,2339218998027956965,8028385331252802586,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:1240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4592,i,4901976103355431314,13074181622485300605,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:14
    3⤵
    PID:3380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,5156353754574401089,16671281695688430953,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:3032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5152,i,15749124726204088183,16666196326444222127,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:2552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5168,i,14791656690092163397,3309584273279949556,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5480,i,2736444639178981107,18385334379184856711,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:4216
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5216,i,18405963497224280041,5080203089011562686,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:3048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5256,i,730753429073089165,13062756971192556815,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:4720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5504,i,16155058638152187024,17772522936660027180,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:5984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5324,i,13864603125275032426,18342548914114878335,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5496,i,11430048915170096944,6528948449665035111,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
    3⤵
    PID:1828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5096,i,5853341068555845330,10892958325700529731,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
    3⤵
    PID:2320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5104,i,17188240590813991055,7225803303133302272,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    PID:4548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,9020591748911386464,717771883286546423,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
    3⤵
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5308,i,10303504200197496062,6363709373632218303,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:9
    3⤵
    PID:3376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6052,i,894876994995916213,12357844131501698709,2097152 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5912,i,4574662772481588303,6663794586298803457,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
    3⤵
    PID:3640
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,2399049860592712415,12211499805904188737,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:14
    3⤵
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,16699699995579586810,254483854575383518,524288 --field-trial-handle=2096,i,1901194122242817959,4126868282436993605,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
    3⤵
    PID:2012

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\Zincite\UniSolar.exe
  "C:\Users\Admin\AppData\Local\Temp\Zincite\UniSolar.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\ProgramData\vpn_stream_arm\UniSolar.exe
    C:\ProgramData\vpn_stream_arm\UniSolar.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\FusioRouter.exe
      "C:\Users\Admin\AppData\Local\FusioRouter.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Deobfuscate/Decode Files or Information

T1140

Process Injection

T1055

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5929f7.rbs

Path C:\Config.Msi\e5929f7.rbs
Size 9KB
SHA256 70a309d1d8c3444053bd8c2eb39374f7da2467412e4e6bb218f582a4607fdfd4
MD5 3f4238253b50cdf1424570fb0f98831b
SHA1 7d035c8af4c4b55b5c04b532e62ee8dabe8662ab
SHA512 a1b9c463cf5802aec30cbe780609e5645f0f3dc33e082cfc0ceff213cac02900e2b1f7dde7241a9a5e053cde9985bb61e01e22f153fced6b46734c9cea3d268d
SSDEEP 96:z8CVhof4d2ur5PpCAK/1U73TCsThqZU73TC6jmHyFmJThq6NHOtVvfXFPe6gAdCU:zBC9OrOI7rOXVzYMjp1c
TLSH
T131122301B98195D2F45D2A36D75BB7843BF6D3FDD622230F05CD8C244E82A49FA8D2D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FusioRouter.exe

Path C:\Users\Admin\AppData\Local\FusioRouter.exe
Size 173KB
SHA256 de9d09f0e26cb4541f5d6788aee22183c6a380a1460f0955171316bbcac5dcb7
MD5 5e6c05d3f8a06f263e1d53fc5c2c53b2
SHA1 d957050dfc3aed8f22d9ace3a5d22192f8527513
SHA512 f3d7f18695dfc24c554443970dedd6ae366dee901241a3ec17fa85f1d00e4459a11802e40e263a4a078974b92652ef2897d2ad2b7edd9c3a08e9954ad24f597b
SSDEEP 3072:1H50cLgcmLDaSaCBLBB5OsA3ivrQgpEsMAl+5xuKjZo2bIlN5+FzE:1Z0cLgcmLuS9FwplLAX2cp5
TLSH
T1D5049D1136E0D072D59239B1A489D6655EBAFC710BA9C5C33AB436AA1F303D3EE3534E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c61e0e3-895b-4467-8958-deca4eb658ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0c61e0e3-895b-4467-8958-deca4eb658ed.tmp
Size 144KB
SHA256 de51deddfed047ad256890de1c215a4af1f32658b0ec461b00d3bdc7269f61b6
MD5 f43f1fcb20d9be599716b40e76a3d522
SHA1 c5cb44b504c512839026ee3d2d6a667901b9ce28
SHA512 b8ae05383863d32aa656bbcee2a8db5db59cc413d249af67ce55e31854ab0fe27f86d1c4d5ebf3b206a7d11ac10d78e54cd145405c123f4f74f05a33cf0b284c
SSDEEP 3072:xFlAufNawP1SAKxlR3DVXt0vue00m8a74ej4Ey+2p/Utkby37J7M:xFLVSAcLTQGexza7F4Ey+2p/UKbAw
TLSH
T1EAE312BF2B9EAD9E822D903E905F34278EC0B9D8E84DDE5E721C351009E74DE1797921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0eb83bfc-f9a0-4653-afe7-e1af6316791a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0eb83bfc-f9a0-4653-afe7-e1af6316791a.tmp
Size 4KB
SHA256 867b4bd14d80c5a13aa1a0ad6af295fa81eff0a5b548780bcb9223e8ced4153c
MD5 246da5297811adfb6422e505a390a6de
SHA1 20fc4e0640a95544df45bb80b6d954325a7bd984
SHA512 6ddd61a14aa9c881c1b2c6121221257d408156a4a5cfb1c6b894e0170d93c4c9516cd2f19fbc44429ee1c3bb7e1b360017432e01bd40bfa99a7e63c91ecbd59b
SSDEEP 96:CC0d+TWqN/K890wxi+9M7fX3urjUBdyRDotok5kUp0cDkJB6vGyvtBWG0cJR3bOj:CC0oWqNVVxi+9oP8DUDky0KkPDeW9cJ6
TLSH
T1D5A12931A869997789F2D585B1463E53CFB830ABA521DFC4E8EE1D1C20F349C0342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3eefa49e-faa0-4f0d-b3c5-982439622cd6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3eefa49e-faa0-4f0d-b3c5-982439622cd6.tmp
Size 144KB
SHA256 67d6d7d5ac2e30a5b91e705ddc8157acbdb3eb32781be0bd46f15eb4dcd01d70
MD5 4a755d18703f4fa7a37dfae5d9e83be0
SHA1 681e891b40c2eec12f925652146c73c822788f9e
SHA512 0e3a293ff0acd5c047827c441aeb0299afc4a8d6cb858be4970009aa57f625d034dff22270a96c8f2824c867433ad37ae595ae01a6b08142426b9223cc62e178
SSDEEP 3072:xKAufNawP1SAKxlR3DVXt0vue00m8a74ej4Ey+2p/Utkby37J7M:xAVSAcLTQGexza7F4Ey+2p/UKbAw
TLSH
T11EE312BB2BDEEDAE822DD036D09F751B8EC074D8A84D8E5B131C751509F29DE2393921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12b3efde-02d9-4df4-944d-d7d921428787.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\12b3efde-02d9-4df4-944d-d7d921428787.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

57d6347b-7630-4482-b56a-630c710e1f19.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\57d6347b-7630-4482-b56a-630c710e1f19.tmp
Size 13KB
SHA256 25b8f0e132934c042bf98724592ee1aac0feee8ab153a7ae77e27ec8e5d1f81e
MD5 c32627f5c1f8b66805cc4a098647b2c3
SHA1 590ff73f3326d66425aa79a4a579083c474c3db7
SHA512 2f4130ad1d6ca358f54b59071cd8aa4bcd3a04f3348ab6779cc3d9c07499994790a9d203cf139a0e2ddfcfbf3c87e01397c1ea4db7f4fa57a1c03f37a9630a2d
SSDEEP 384:usjYb7KxkXqKf/pUZNCgVLH2HfgslzFXODYX+ErU3kNHG8xMkkwlF+S2:ugYb7KxkXqKf/pUZNCgVLH2HfgsRBOE4
TLSH
T15C52F76B644C9A3F0FD8DA4DDC177F4FACB502466268096857FB9C1903A5BCB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ff2ac02-626c-46a6-8409-c2a611043479.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6ff2ac02-626c-46a6-8409-c2a611043479.tmp
Size 11KB
SHA256 4e5e680b0404ca48809c1ba7fa0fd4196c956c62debb9ae53fd5667052381b1d
MD5 01e05ac4dc4606a5f9c947af7ce529a5
SHA1 3076744d54a3afee4da051bd61c93820cad35a48
SHA512 1dfbfd2c8a1deb352cdb3875de322eadb3db10c4b6a39e71c1c2fb945051586eff018fdee99a81b4271f6266beedc2e2110b5385b8004704043d8ef6cf811ccc
SSDEEP 192:gRkS03qBJvTFSJv7cvKPRp4GXsb+WNnSxPkyzWAggkwNwiyIsnAUgE:gRUkF6A0XPXwWPlWAgg3E
TLSH
T1CB42A52DBD10B53B9CEAD319FA267B53D6F5103234A12E84E6FD892C15E79CD222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

270e0fdb-b891-43fb-af98-b864d53d7950.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\270e0fdb-b891-43fb-af98-b864d53d7950.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

38841799-0750-4b93-9b4c-b4aa41b52da1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\38841799-0750-4b93-9b4c-b4aa41b52da1.tmp
Size 1KB
SHA256 b66a9779ee03160d3454f79a6bdc6ebf927f562c6857eeeb7056aacbf069b31e
MD5 d3a65d0a8fc7f58bb2f51824a40004f8
SHA1 fbf6cdd2f4cae8f6f14276ee611df3dac8a1f2ec
SHA512 dab9be37ed4d2dac6f1b5725336d956b5e56412f099645a54407c32030833683e274c7d9cfec00c0c1889522467e45e1a446ad6ed70fc2269a91e72e644c68b0
TLSH
T133317CF7C7E4857D8A1152F4EB15AE2FCE6E0924031C3C6688E46E5B57F2872D20479E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a3de446d94d96b3e9a0fd39f531fe4c985dc4bec34a7cf9d9876497baf9fa6b7
MD5 5a36d1ebdf68162be8facddca2660ca6
SHA1 9e99f2cb5b28a17529a9717fa9202779fca45494
SHA512 5ca8d520e3bd0159df4f3cebfcddf9cc183bc6e3022082e13cef4d3550eb81a67345e44958535f68df40e6ff42d72b7ac19bfe704d77db15dc0ca629f1d1b125
SSDEEP 192:gRkS03qBJvTFSJv7cvAPRp2GXsb+WNnSxPJyzWAggkwDwiyIsnAUge:gRUkF6A6XlXwWPKWAggde
TLSH
T18E32942DBE10B53B9CEBD21AFA267753D6F5103234912E84E6FD892C15E79CD222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 2d0a3f7c44f4c7e4e2d3505d6e06468746eff7593c3250a996f48ff1750ddb52
MD5 e19fae5f694f478a3c143ab351ca21e5
SHA1 15ebcd422b5fc312b8ba8788191662c33fcfca23
SHA512 77a623a0f23c88d6ae29dee40e3caab15b545caad4e9e6fe6d569a1310de1498ebf30732087f060e5b84af6745657fd93af8363268d82f43e8f722ee6e2463fa
TLSH
T155A0029141D08561DD025271F5A1E54132614934576147036CEB9B75D85B2D24183500
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 a7126ddbfd1470826f9255ce12a3eb09959827201efabc1b3d3bb2e1f9970536
MD5 9ab447e76093d54554a2fa6b36f79c38
SHA1 fc9be52a0e852fcb4d1efaae18f97518dc7bb9f5
SHA512 e23b565d15be7ad8b9374b50b3314095a1aaa1721f07ba3d25ae69a35d42d128157b4be9b9bffc021be63a8518b20d3d6580f7701ec1c5ce0730dc22be1199f0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

b70b462b-7679-4649-ba70-e2312a77293a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b70b462b-7679-4649-ba70-e2312a77293a.tmp
Size 144KB
SHA256 25f623a9936fd89bbb8ea7201363f7844134b0418d27f3ef9c34ff8c40923aa5
MD5 df3950fa331db56c69209c5d4a0fbbe0
SHA1 109b38b65ce13a2039a4528e957e8e707f0b9a7e
SHA512 e915951b05a4666b8bcc20896b2a43abb0e878ace1e51cd57a261c7462c58e58f38303643224abf78bc4cb3cff5deed7c04fabf7b919eb0c848f272fdd78663e
SSDEEP 3072:GKAufNawP1SAKxlR3DVXt0vue00m8a74ej4Ey+2p/Utkby37J7M:GAVSAcLTQGexza7F4Ey+2p/UKbAw
TLSH
T130E312BB2BDEEDAE822DD036D09F751B8EC074D8A84D8E5B131C751509F29DE2393921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2D49CA6.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D49CA6.tmp
Size 40B
SHA256 33e25ed6b4d6cc14bbe5d293541a0362694e04c5d81fd2a12cdd6257800068a8
MD5 3c993ca12a597f755afe61b4a257316d
SHA1 a12a00110873e4df2bd19a1df8e5e75f8da068e4
SHA512 2869961fbb87b8ec44cf71a4dfd760f9c3d0ffaa05428f87ab8b031471c438e4b33ffe5eb7798d323986a0c46696cb5420d5a32e6548fe620a06b824c012d085
MD5 SHA1 SHA512

Submit Download

DD16817.tmp

Path C:\Users\Admin\AppData\Local\Temp\DD16817.tmp
Size 3.2MB
SHA256 1623b61e67c9f89024d942bb2918d39246194673a0bdc54b2588344dda73f3f6
MD5 92171d772f226d2b04e9efc367ad4e70
SHA1 bbc9434a957d86d84894d7d62ee94288ae4e4f14
SHA512 80c35e19b2997a278ad40abe5ebeaedea4c873ed277b16e6c6f1543198d3b84d65c95a1c698b5197002d5e5ef6121d264cb2a74c890eae89a37611eb859c3d4e
SSDEEP 98304:Tink8jg4HMr0EHuvdsNWrmPpN+fMrrCmPIN5DY:TinkHoiK7mPyKTII
TLSH
T17CF533DAF6DB1A12DCA48A28AB4404816455EF8469352B8561E38817FF0F5C93CFFECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UniSolar.exe

Path C:\Users\Admin\AppData\Local\Temp\Zincite\UniSolar.exe
Size 1.7MB
SHA256 0f28bb5da4e663ec60ec3808f4b8fc956017d5dd903b3b5b18d3e0ddc5c8e0f7
MD5 a82aded500d93ffb3ced6e5658bc3404
SHA1 4ffe080a3efd19dc19e69c5dffa62ec8d8d0cf1d
SHA512 7c4428a7fcaec63bbe4a408713e59fa59a601aa5ca7035fef8e00c539c917375a847f78d53259e3460223949fcabe5de52cfdfa134b1b53f4528c29708d524c1
SSDEEP 24576:7ip+eMB5CzFwhStFNEWwerW16DWpt8gd5rsNPyeDh0lhSMXljmm8/ytGc:4MB2FAStFqff/8gLSyZ8/+Gc
TLSH
T144858D317105C036E69212F1A86EAFAE969C9D340BF658D7A3C43F6E59301C37B35A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

brokermod.cfg

Path C:\Users\Admin\AppData\Local\Temp\Zincite\brokermod.cfg
Size 132KB
SHA256 e841ee5855b0c7f03f276250138b5e95f8e33fae9d48ca2edebe589282011e6c
MD5 73367f0f113ccb9555312c131a1432ae
SHA1 a18ee58ed5e6bf4594028795c154a7468c745123
SHA512 ed03269ac59659585fdc6748883726a8039665ab4dd2c3d93ad89d4ca07a229bae3ba8406268775943261adf78de59f70302103693136922d2fa2dd6390fa1c0
SSDEEP 3072:GN94K9iDHISlMVaEgLgK9GzdfyUhdLpOzuvQvHMIuuNwcy+:O94K9iDH/lMVLgxQpfyUhdLuYQ5uUwcF
TLSH
T159D33788625E5D2C75DB9B9B5524E082CE60A0BF2FFD00A5A47CD44E7E3C3AFE527502
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

discord-rpc.x86.dll

Path C:\Users\Admin\AppData\Local\Temp\Zincite\discord-rpc.x86.dll
Size 566KB
SHA256 a8d00571b87cedd357de23a2fb893e57ebb89135fa6ff45854e8ec2ab5145f2f
MD5 da5863603f8724eb157a59b195daf815
SHA1 7f89a4af743c2ece6995aa1b863cbe2d7175a083
SHA512 f9794106f8cfb584e0784db6a09eaa954bfc547a49a851160553119819736e84865eef42cdca575b84c675a643f222dde11c26a84855282d0aed4892a5e5a83d
SSDEEP 6144:KWJsNrb2/twRx2ax9L66vBvOz+f8uOU3g86oxaeZnyHuKfILznkw+:KYqHKtEkaxcuBvm+fnZcuKfI3+
TLSH
T18EC46E11B4808271ECEA21BA42ECB63642BDE4F007156ADB5BD80BFFE7605D1AF32557
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mesh_shim.lock

Path C:\Users\Admin\AppData\Local\Temp\Zincite\mesh_shim.lock
Size 2.2MB
SHA256 1d8e075870ed3fd30341f4fc885642c34e68cf6944950a1a047213406d6fb281
MD5 1c85d76be923c2bd5bc431764c44805a
SHA1 34f6a9441c4bb71e25985772fab2b2db2adf4a4d
SHA512 1f4eb564a7a110b654aa11de6a94729694261dd7b6c5645c9a0e5e05dc9bd59d7d1eee072271130372115b153f4005d7d03336c914a0e3a9d4da11f480dc5be3
SSDEEP 49152:NlwHj3GJ/UZfRTvElW1jSVD1XLwBfNoNnokkvTiMJJw/8Ll:NlGGWZZTvkW1j4C7oBbMbwEp
TLSH
T173B5233E4E4DC318DB8772FB7288E55B58751ECC1239723601BAACE7D58C5CA9229363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp_win.dll

Path C:\Users\Admin\AppData\Local\Temp\Zincite\msvcp_win.dll
Size 493KB
SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
MD5 7762c51ea02eb943183d597ea0ee5530
SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
TLSH
T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_api.dll

Path C:\Users\Admin\AppData\Local\Temp\Zincite\steam_api.dll
Size 258KB
SHA256 8d36de57cc6436f4e82ee672023f17a7f83a7a55af558582c2c139f83fb33ed0
MD5 5be6351ea71a94ca4334f3211f5eb609
SHA1 1a5a83bebedcb499128219805296f042e5b9d159
SHA512 f61cab57849d12e9e0a26e73d20fda28085aff2e1a619501d25f9736ff455444a5d05d722ca32bb2356d5b209e29982ab93fd4e6b84acf4cb4b3ab5474d01655
SSDEEP 6144:3isYYCtnsm/LnKNtYMHGAIk9DRFjsylO2Cu/R6Ugf:ysXCtnsm/Lit7mArQys2C+6Ugf
TLSH
T17444383538A148B1E5B581358AA4DE2F3BEC216B37342CFF634806B5C9636C35A3759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\Zincite\ucrtbase.dll
Size 1.1MB
SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
MD5 c4a25dce665733663284750666684703
SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
TLSH
T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6b11709-b176-4d58-97b6-53c43a97f692.tmp

Path C:\Users\Admin\AppData\Local\Temp\b6b11709-b176-4d58-97b6-53c43a97f692.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6128_1630950908\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

~940533d4.msi

Path C:\Users\Admin\AppData\Local\Temp\~940533d4.msi
Size 3.6MB
SHA256 ece6076ff16c28e6cff700699710f73a6beaceddd00dda665c79f0ac467522e9
MD5 903ea2bd91cd8c56eee72c293b7d8c58
SHA1 0b7b49ea9d5f2cb0eab6f7bdcc73e243be10b431
SHA512 59d2b95ff023715981a0c8592b78fafdf1d7044be0648d310dd5ab22e8ca183d83bf2572984fc593dfbfe92a534bce73704f8bdcdb1fd84bab5731285a186d8d
SSDEEP 98304:VVSB63lzjEpbAQJ8jPQMhtwT89jCqnkvCgpupW/D7:PS41ksGmhtwg9UB/n
TLSH
T19806339A3BC16D03EAB7D7B505FEA9729FB6CD144F29445230833A096E31BD680E63D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-32-0x0000000000D20000-0x0000000000D27000-memory.dmp

Download

memory/1104-34-0x0000000000D50000-0x0000000000D58000-memory.dmp

Download

memory/1104-31-0x0000000074F40000-0x0000000074F88000-memory.dmp

Download

memory/1308-57-0x0000000000B40000-0x0000000000C16000-memory.dmp

Download

memory/1308-50-0x0000000000B40000-0x0000000000C16000-memory.dmp

Download

memory/1308-132-0x0000000000B40000-0x0000000000C16000-memory.dmp

Download

memory/1308-56-0x00007FFB52760000-0x00007FFB529C3000-memory.dmp

Download

memory/2728-42-0x00000000009B0000-0x00000000009B7000-memory.dmp

Download

memory/2728-41-0x0000000074F40000-0x0000000074F88000-memory.dmp

Download

memory/2728-43-0x0000000000DE0000-0x0000000000DE8000-memory.dmp

Download

memory/4092-40-0x000001FE16E50000-0x000001FE177F4000-memory.dmp

Download