5aabea7f15b2cadb7d0c72ce8127c2690ce151fbca4b3d59f98a357d5edc2e02

Analysis

max time kernel
900s
max time network
875s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MegaBasterd.exe
Size 1.0MB
Sample261102-sppmmads2k
SHA256 5aabea7f15b2cadb7d0c72ce8127c2690ce151fbca4b3d59f98a357d5edc2e02
MD5 cdbe768eb6c56bb16c8322e0944e974a
SHA1 537d332be71948fdfb97ee952a62ed1904f497f9
SHA512 93c7126ce96559acd459212d90801cb2a9dcce11f477fc4d0497422ce8d9cb2ba686012bda540c6822ebce2ef73d5e99be605f400cb5c88850dae1264271505f
SSDEEP 12288:0bKzuyVCt5IQ6RmjgmTwk6Y29ib04ZU5anejz7GS9OdJKGBdfxijNjfe5y:0bUuyVxoVA9ib0GAkrfxijhfL
TLSH
T1F835CE61A7B30FFFF5EEC13445160E11E6A1381C47E05AAB438C52D7DE62B857AFAA10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence spyware

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90
PID 5144 set thread context of 5936	5144	explorer.exe	90

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Npcap\crollailly.dat	explorer.exe
File opened for modification	C:\Program Files\fickle\ielleuzeey.txt	explorer.exe
File opened for modification	C:\Program Files\housemaid\oartyiold.cfg	explorer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
476	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{1FFC2E5E-EA2F-4756-9B57-19D3BD7DF8D1}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5936	chrome.exe
5936	chrome.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5144	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5144	explorer.exe
Token: SeCreatePagefilePrivilege	5144	explorer.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5144	explorer.exe
Token: SeCreatePagefilePrivilege	5144	explorer.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5144	explorer.exe
Token: SeCreatePagefilePrivilege	5144	explorer.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe
Token: SeShutdownPrivilege	5936	chrome.exe
Token: SeCreatePagefilePrivilege	5936	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
6020	MegaBasterd.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5936	chrome.exe
5004	sihost.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
1680	explorer.exe
1680	explorer.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
5144	explorer.exe
1680	explorer.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 5144	6020	MegaBasterd.exe	80
PID 6020 wrote to memory of 5144	6020	MegaBasterd.exe	80
PID 5936 wrote to memory of 3008	5936	chrome.exe	91
PID 5936 wrote to memory of 4628	5936	chrome.exe	92
PID 5936 wrote to memory of 4628	5936	chrome.exe	92
PID 5936 wrote to memory of 476	5936	chrome.exe	93
PID 5936 wrote to memory of 5232	5936	chrome.exe	94
PID 5936 wrote to memory of 5232	5936	chrome.exe	94
PID 5936 wrote to memory of 1088	5936	chrome.exe	97
PID 5936 wrote to memory of 4536	5936	chrome.exe	96
PID 5936 wrote to memory of 1088	5936	chrome.exe	97
PID 5936 wrote to memory of 4536	5936	chrome.exe	96
PID 5936 wrote to memory of 2884	5936	chrome.exe	98
PID 5936 wrote to memory of 1356	5936	chrome.exe	99
PID 5936 wrote to memory of 2884	5936	chrome.exe	98
PID 5936 wrote to memory of 1356	5936	chrome.exe	99
PID 5936 wrote to memory of 3808	5936	chrome.exe	100
PID 5936 wrote to memory of 4124	5936	chrome.exe	101
PID 5936 wrote to memory of 4124	5936	chrome.exe	101
PID 5936 wrote to memory of 2852	5936	chrome.exe	102
PID 5936 wrote to memory of 2852	5936	chrome.exe	102
PID 5936 wrote to memory of 2424	5936	chrome.exe	105
PID 5936 wrote to memory of 2580	5936	chrome.exe	106
PID 5936 wrote to memory of 2424	5936	chrome.exe	105
PID 5936 wrote to memory of 3012	5936	chrome.exe	107
PID 5936 wrote to memory of 2580	5936	chrome.exe	106
PID 5936 wrote to memory of 3012	5936	chrome.exe	107
PID 5936 wrote to memory of 3944	5936	chrome.exe	108
PID 5936 wrote to memory of 3944	5936	chrome.exe	108
PID 5936 wrote to memory of 4896	5936	chrome.exe	110
PID 5936 wrote to memory of 4276	5936	chrome.exe	111
PID 5936 wrote to memory of 4896	5936	chrome.exe	110
PID 5936 wrote to memory of 832	5936	chrome.exe	112
PID 5936 wrote to memory of 4276	5936	chrome.exe	111
PID 5936 wrote to memory of 832	5936	chrome.exe	112
PID 5936 wrote to memory of 3728	5936	chrome.exe	113
PID 5936 wrote to memory of 3728	5936	chrome.exe	113
PID 5936 wrote to memory of 1300	5936	chrome.exe	114
PID 5936 wrote to memory of 1300	5936	chrome.exe	114
PID 5936 wrote to memory of 620	5936	chrome.exe	115
PID 5936 wrote to memory of 620	5936	chrome.exe	115
PID 5936 wrote to memory of 4372	5936	chrome.exe	117
PID 5936 wrote to memory of 1092	5936	chrome.exe	118
PID 5936 wrote to memory of 880	5936	chrome.exe	119
PID 5936 wrote to memory of 5836	5936	chrome.exe	120
PID 5936 wrote to memory of 1912	5936	chrome.exe	121
PID 5936 wrote to memory of 1912	5936	chrome.exe	121
PID 5004 wrote to memory of 1680	5004	sihost.exe	127

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5144
- C:\Users\Admin\AppData\Local\Temp\MegaBasterd.exe
  "C:\Users\Admin\AppData\Local\Temp\MegaBasterd.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd61bcc728,0x7ffd61bcc734,0x7ffd61bcc740
    3⤵
    PID:3008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,1597324469999177010,15973207365509269555,262144 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:4628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,9814139124898021026,11098215891871517429,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
    3⤵
    - System Time Discovery
    PID:476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,9620603933957023751,17819236829923778083,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:13
    3⤵
    PID:5232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,5677602489766010346,15024536440009014108,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,9849340795347466002,6788708643453875984,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:1088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,16046964542782194670,4484157145447595551,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4516,i,10458464047905533758,1520927171117218200,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:14
    3⤵
    PID:1356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,10958141059618614247,428041593814723900,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
    3⤵
    PID:3808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5328,i,1901848120153454801,7540174532912297212,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5316,i,13434124028928070627,15551486968605366354,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:2852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5304,i,7537072245889448194,11244209249012964194,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,17145686888265473384,218385540324809128,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
    3⤵
    PID:2580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5704,i,7196260854193515488,8659891060169492664,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:3012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5332,i,437718745959437671,1333721687961167441,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    PID:3944
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6068,i,5166901780311287909,10719937458232609999,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
    3⤵
    PID:4896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6196,i,11786318097658040154,9618411923543828751,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5208,i,18178846003114832926,4479811700476054457,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
    3⤵
    PID:832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,8508746907197149734,8227914167472845497,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:3728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6064,i,11543112812902232160,6431492433337828002,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:9
    3⤵
    PID:1300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4724,i,1383274090020563385,2901262831846746948,2097152 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
    3⤵
    PID:620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6092,i,16025494749606119046,4349363637428162187,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,241086907084495435,3730767574483031309,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
    3⤵
    PID:1092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,7971431146188147752,7851180223368250774,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
    3⤵
    PID:880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=896,i,13133448603949995973,16713894051738230891,262144 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:10
    3⤵
    PID:5836
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,1180865264295084755,49088007189998857,524288 --field-trial-handle=1944,i,17003046568041172954,11598248430397512714,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
    3⤵
    PID:1912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5760

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4720

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

34f986fc-7b30-47f9-9186-73e11bef71a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\34f986fc-7b30-47f9-9186-73e11bef71a7.tmp
Size 144KB
SHA256 b1b8035633ab4ab5a66e8c3bf4e0d28918b707e2218f59d813e6947b73d6769a
MD5 793eb12fac746d11c4de05ae0b48a7ac
SHA1 bfd94882c0995edc0d66bbb389bc24d61d982140
SHA512 f04401e4daf6aceac26de9574992a13b8dcec638ad779695038bf1ad57a7e811a8f76201d2cecf734b90716d24379487f567c38b7072a507cb6ccf77ded500df
SSDEEP 3072:9ew3vHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNTO:9ew3vHWe40m3otUf+8Wp53EX9pxsNTO
TLSH
T128E312788DCA6C77AEE8415F380ABD071EBC8747E255CD107DF5390B361ACAE0A63161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

87413793-242d-456f-841f-0a183ee94a1e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\87413793-242d-456f-841f-0a183ee94a1e.tmp
Size 143KB
SHA256 6a7d31f1322fcb3a568a24b9f0a933ca52b2a9744c994376bfc3377c4a481d9b
MD5 72f85494fe047634047f2810590f27ec
SHA1 adc03289035f50b2f529ae4b4c415b7dc0d7b2d3
SHA512 6b14b3da5c837ed2ba7bad91a9ac07120442fe23fb96926f4e99666335786957b22130f4d7096d917093dbe47a24ad9aa308e66420a378db7f7d2e5ee3160848
SSDEEP 3072:AeOvHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNTO:AeOvHWe40m3otUf+8Wp53EX9pxsNTO
TLSH
T1C9E312688DCE6C77AEA8819F390BBE075F6C4747A255CA101EF13A0B3616CAF0663571
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95c79476-0ed6-442e-bbb9-6020302b19d3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\95c79476-0ed6-442e-bbb9-6020302b19d3.tmp
Size 144KB
SHA256 ccb38bd75c213f4aa5d0f102007ff26a431c7e9f556b4aea3e85e8102d2c41bb
MD5 2935312e3c6f17ebcda4af68f56ebe00
SHA1 e903a8efeed0531ff89d6f6894c15244645d3039
SHA512 996110748ae2e5ee98426ce177d9cd4151c6286189957b67d1950c92b76f7c208a06391908d385d4e5f00faad1166fa3508053994c63164517b6c1023e12b0e8
SSDEEP 3072:5ew3vHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNTO:5ew3vHWe40m3otUf+8Wp53EX9pxsNTO
TLSH
T16AE312788DCA6C77AEE8419F380ABD171EBC8747A255CD107DF5390B361ACAE0A63161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
Size 114B
SHA256 6240c3aafb146e80e3e9b8a92649218ade039308ccf8b72f3855956cd7d2c910
MD5 5738c571abe24e9e2b3221462bf9ec02
SHA1 dfa0809f2d7463ff506fbda1cb74eeede6a21210
SHA512 ca3beb3b8f5b0b3158da100eaba8302956824df8fc46796a0b387dece255a01aa27c82118b36554e50faa526737eff51a34cbf4f6307119897c5a33148a1e426
TLSH
T147B01214B3647592C80297F764C1905AF30023C646330049839664942CA471047B4054
MD5 SHA1 SHA512 TLSH

Submit Download

8ce428a8-905f-4383-b2ae-ad424e309da5.dmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\reports\8ce428a8-905f-4383-b2ae-ad424e309da5.dmp
Size 114KB
SHA256 8dc411468e0356b42f4a7b99711f67ab5a10f8228f4980303a60e6d2f6b61bce
MD5 84a3a82f316d3674b7939171acad02df
SHA1 cd0a85ea200249117e310cb41fe610a7819fcbfe
SHA512 6abc67248affa25fe668bc3617a7048734b5838f45268a6d752d095a1163679c19efeee97b69e0a3a021a428ba366d72dab0f70e82b242cdc051f27cf03820cb
SSDEEP 768:shWqlhSOHB1p63tPQYs4jf+dmOKi6YyATolmH6rCb:eh5DMttf+sOP1T5aeb
TLSH
T19EB3E916B39A14F5F2A6423098DB7711FBF3E8105B620B1B46865BBB1CA7704AF71F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 84ae77e4d131e93379683481e2602a0250f7ccaba40692ed2949a816431c9da9
MD5 ebcc9a297e5c474090962ed19a5e48a9
SHA1 2e86ffcad4ddd1266a3658610fed4361bfa6153f
SHA512 1346cabd9fe762b02f75bbf7904d7abe5469c2a7cef859aa89ea76204ae27b1759fd0a4435de57059ad8d709fdc549c5703fbcd74fded771fbb19adb99bde62a
MD5 SHA1 SHA512

Submit Download

1b960172-5b78-4be5-8e89-3c16e53a83c9.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\1b960172-5b78-4be5-8e89-3c16e53a83c9.tmp
Size 13KB
SHA256 9a0cf06bc124876736babd02e9e4dea777d79727db1c340b4e2241b5b059f2c5
MD5 7e7ba86f9cd328158e2d3ab17676b9ed
SHA1 074b2a313e2ecb672113da9c2d13485df7dffd20
SHA512 5a9f383b0dc30b44efdc6cdafa61aa9130c1d7b3793dc1bf7880c4aa623675ed9011ec4f60394c876420aa0b839b379aa3c4eaced606a65ae3f1baba356992b2
SSDEEP 384:dXj/y7KxkXqKf/pUZNCgVLH2HfgslsOXOD/W+ErU3/0HG47v/Fy:dz/y7KxkXqKf/pUZNCgVLH2HfgsiUO7b
TLSH
T193520967688C9A3F0FD8D64CCC127F8FACB501666678496452FB5C1903E97CB114A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

338ff62a-a2f4-4a9b-b2f6-ea32c55c7a28.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\338ff62a-a2f4-4a9b-b2f6-ea32c55c7a28.tmp
Size 12KB
SHA256 2ed5826cd020bc1d8bd167ba4a1f80572a81a7537ff5bdf06f0910239f94ed94
MD5 545bb9e3b03987aeb00656198afdbbb0
SHA1 35afd9504e7fa3f21283d941e013a7a45c74e1f1
SHA512 e660d02af36d91f1ce029714a08b02360729fdd820db9d81d2f356ee97b81dc22d7176d9c25de65dce60306f3efa868b6351c003664f17606bb0e7ba510fe52a
SSDEEP 192:vR7Fnldv7ZIPRpWN9THsb+WNniY0VkXhe22KbaT5VyIsnAUgE:vR7FldAXu9wx0KXl2ea7E
TLSH
T169429429AE20753FADDAC219F9657B53E2F5103265D02F84EBFC892C16E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

987d40f0-5477-48c1-9640-68a9af346f64.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\987d40f0-5477-48c1-9640-68a9af346f64.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2ed48366-b886-4d49-9779-4d8c76e0639d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2ed48366-b886-4d49-9779-4d8c76e0639d.tmp
Size 2KB
SHA256 571e75441ba55dca156867b1d90f16936adb92f3fc642a88ac0fd0810de7960e
MD5 f771ee87af924de2704418e081407c94
SHA1 a953fe7b43e683174bb4650220d63b8fb0d16bb1
SHA512 8ca28bd658f6b0cd6a8356f2ce63b7925ae0001eb2f63365c5802429494cf1231b282e6d31cbb1f9b6bd30581ef360c04863c1896d520767bc26719a1a53d1c3
TLSH
T1BE5179B7D3D4866DC95156F49B21AE1FCE2D1A28021C3C66C8D8EE4B53F2872D25178E
MD5 SHA1 SHA512 TLSH

Submit Download

44097d1a-1403-43ef-8f71-7af30a1ee6ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\44097d1a-1403-43ef-8f71-7af30a1ee6ed.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

65e352ff-d1a0-4cf1-83ac-ade3f511f73e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\65e352ff-d1a0-4cf1-83ac-ade3f511f73e.tmp
Size 2KB
SHA256 a6fab9c44ae93b74d404698278ea37292de4637285f4b67e8f3157b2fa41fdf8
MD5 0c5bffcec9e01e4e88d15338454b5175
SHA1 4c9ff6e574f1ee81cbc12b185123d2cd7ad3434b
SHA512 7b0b8635f138e156dc94581a86faa7f9a90c3d9a7a119f145a90e566d36af62ca9b5854e2c8efed68fc2df4fecac02aa0ddc8d81a62c7df15e5215bdb689274f
TLSH
T1C9517BF7C3D4866DC91156F49B21AE1FCD291A18022D3C66C8D8EE5F93F2872D25178E
MD5 SHA1 SHA512 TLSH

Submit Download

af1e778f-6af2-4660-bfb2-1ba78a4774c6.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\af1e778f-6af2-4660-bfb2-1ba78a4774c6.tmp
Size 523B
SHA256 49004042e20863889ff69e8a5a5c440902013e4ca431a01ea0408c65fc81c162
MD5 70fa8778649459b50baf40d024f26ddb
SHA1 be7d3dde0fdc6a00ec63c797437dd21355883f22
SHA512 6ff4a52a5f94ab5cd928d7987043c60a15e0f3a85503d26a03476f6cdf6fa22ea521cc97014e84d11ee7bc6e86cea6414d8904c2b344bc1da084502bab555df8
TLSH
T1EEF059B7A67A796B006D44FB1D00B8592D76E431038158F0CE9A827CE0862F71B12097
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 87c8b172d7786eeff4ae72eae2e3d9342c92e82b0c9343255028ed6dc2495956
MD5 939bf388137dee1d8f43874508d73612
SHA1 a346331435286a4daf9d249b5ae153d5f20dc1ba
SHA512 4ab57fc73b29f8da5b391ac55f38b2fc49cd79bd5f5af104555ef720f10ef9d2159c9c9e30b2aa087093ca0790dc14aeb26bbc50e341057db26dd57efa59cb44
TLSH
T1C1A0025052C14616CD4157B0B163499A62528C581A518B07949F45A98B9B6D26DD1201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 426231e0d5d0b823523db3ff0d165f04ab357f47557e0927569df772828f607d
MD5 ecbf2ca515f1ea783f5aae6c2f676384
SHA1 16c86aa0f3af1673723148b399e38aac0c769963
SHA512 422c8e9a5aa296a7326939693346ce7bbb64a566b6038e33bf9b917d59fe1cb00ac2ae643aa45812ca1b4aefb8978ad3df456044b306662fc8f5dfa70b5115b5
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

a8687f62-b8f5-4fd6-9d97-25cd966e87b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a8687f62-b8f5-4fd6-9d97-25cd966e87b8.tmp
Size 12KB
SHA256 d797b724806287bdcbce2fc4ed0956ed0de9aa444d751481769588face688aec
MD5 259234e59790d9453d125b27289a2eb2
SHA1 e2ba96eceb872943b7d73a8d067403247e998f34
SHA512 d4bbf03de765eddc9433a8220f7d83046aa25847a6be975591bb053dc67159b5fc23aae2b01538e2f0d0ebc2fe714037d345e9525f2ef0a089d8e3cf63ef2cae
SSDEEP 192:vR7Fdldv7ZIPRpWN9THsb+WNniY0VkXhe22KbaT5VyIsnAUgE:vR7F7dAXu9wx0KXl2ea7E
TLSH
T14C42942AAE20753FACDBC219F9657B53E2F5103265D02E84EBFC892C16E75CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b00ae733-8195-45f4-ba9d-2042865daa53.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b00ae733-8195-45f4-ba9d-2042865daa53.tmp
Size 414B
SHA256 1fd4b395634fcd17297a3087996102f222e01a1688609c54f7100cc5308ca75b
MD5 26cb93583d724eeb949c386f9e306cff
SHA1 57423c2442fb1e1eb68d3152f3691640aa78a320
SHA512 d64a7a9ea86f0857aca9f41c697ce4b419ce5655b3d8d677e2c0eb2e84b0399ab1acec2365044a0029ffde396b2af537e3b60e19aa022ee7fd7e66e55fee42cb
TLSH
T103E02BA9E921EC2B19FC0B1854544346FB5507572A904B0B3A3DC14C8FF562E41D682C
MD5 SHA1 SHA512 TLSH

Submit Download

fb7e1303-3d9e-46ee-bb01-47b974f1d53d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fb7e1303-3d9e-46ee-bb01-47b974f1d53d.tmp
Size 11KB
SHA256 d203ef169c0ba08aeace82d19efe1e51a657501d67005cd6b56869800c2d0589
MD5 d0acd6f98805584b4ba8c7938864ded3
SHA1 abba8ef89f9998a13409340804fa7d27411276ac
SHA512 c417d6d2456926737d9b782fd7e0f096f3a433ae0d5cac1424a8d24a420209d1f47fa3bf970586dbafd3fbe96c09e53f433319247557db7b3bb91126d635c7aa
SSDEEP 192:vR7Fnldv7ZAPRp2N9THsb+WNniY0QkXhe22KbaTgVyIsnAUge:vR7FldQXO9wx0pXl2eaQe
TLSH
T1B2329329AE20753FACDBC219EE657653D6F5103265D12F84EBFC882C16E75CC222B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4d4b3b1-d33f-4f38-9adb-09fcc844a116.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\d4d4b3b1-d33f-4f38-9adb-09fcc844a116.tmp
Size 143KB
SHA256 efa887bceb802f4ccfdf88d963ffb37e01c94b52b06626881fb2a17c14f26bc4
MD5 b3aa1d5864576e7eb9e1108e88125f59
SHA1 14eb9d944314bc1ea4114b4b6a1f81b358f1ab9b
SHA512 782931ce2de66e01b3c77a79b1a7992582c9876d0cc2bc6663237ee97e9e7de8a260b392cf37b1b96167bf73127b30532ec6a6c4d175ca6df1d3452e83149293
SSDEEP 3072:5eOvHWedSNVHKzDm3o2+9Uf+0neqlWp53ESoZ9pxOLNTO:5eOvHWe40m3otUf+8Wp53EX9pxsNTO
TLSH
T186E312688DCE6C77AEE8819F390BBE075F6C4747A255CA101EF13A0B3616CAF0663571
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f78146f7-79a6-4073-b15b-c59ea9ad1c3d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f78146f7-79a6-4073-b15b-c59ea9ad1c3d.tmp
Size 4KB
SHA256 2784e707c10befa6120c7d7961cb2bed1da76f8dfa28bf842c089cddc0ae47f5
MD5 c36a706b01c2ea736f6efb23b247ca58
SHA1 a3a3b162cf57e665a1bff67e7e192eb4f3306c5d
SHA512 2dd4912c97e7d5f7753c69aa56fb0a89af395036e0842c8024a01c6bdca4d9d44ef9201920bf961d934363bce80c31fbff87b75ec638c5e4abd143ab83d0fcb0
SSDEEP 96:pC0d+U7D/u1i5WFtfvuvTj7sCRDotok51HDJB6jGyvutFDLmmbYLsv4a:pC0z7q134vtDUDdPf7FDLmmbY6
TLSH
T165A11970A97D99BB9876C485F5422A47CEB022BFA901BF84D8DD1A1C11EB1EC1312A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IconCache.db

Path C:\Users\Admin\AppData\Local\IconCache.db
Size 13KB
SHA256 63f9dcd85b5a75d1c5b129fd4c626a4d08bf19822fd4c1b2b06881fe16e0377b
MD5 a4deff4649cb33baf3531708a92f0a50
SHA1 de76ae47b1cd96b0b7b6d07fcd69de6686e99a43
SHA512 2efd8b72b7762b4fdc2996cfd7705d4fcec97e5562f54e8ebc28730487f80e0c4fed72fc37a5db56edfd7f4193504935a4c7f3adbf17b30561a9acacea480a56
SSDEEP 96:1rNpYe/q2mv60O1W3IpKrQgDspCfwUd+yCaaxQrLd9riIMiL/iqiziKiligliGi7:1rQsEZ4izWfMBl3HK/sy
TLSH
T1FF527A2427F92224F7F78E36BCF1AA579876BC454C26CA8D024997CC0836E64DC71B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3bcac475-95da-477c-9942-90d2ee81805d.tmp

Path C:\Users\Admin\AppData\Local\Temp\3bcac475-95da-477c-9942-90d2ee81805d.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5936_1996220965\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5144-25-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-24-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-10-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-7-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-46-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-11-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-12-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-13-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-16-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-17-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-19-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-20-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-21-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-22-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-447-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-23-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-26-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-34-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-8-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-9-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-33-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-28-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-29-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-27-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-30-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-32-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-31-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-14-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-15-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-4-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-6-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-2-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-0-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-1-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-618-0x0000000003A60000-0x0000000003A61000-memory.dmp

Download

memory/5144-621-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-623-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/5144-3-0x00000000034E0000-0x000000000358F000-memory.dmp

Download

memory/5144-5-0x00000000034E0000-0x000000000358F000-memory.dmp

Download