Analysis
-
max time kernel
211s -
max time network
222s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 15:42
Static task
static1
Behavioral task
behavioral1
Sample
Station-Setup.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Station-Setup.exe
Resource
win10-en-20211014
General
-
Target
Station-Setup.exe
-
Size
132.9MB
-
MD5
c890a32c24beee148d2ae84caa8016ea
-
SHA1
44386bd7d31cd9ec08b32ec366dec5a9e30abe11
-
SHA256
dc39a617cbc810947288e1807ae25a5818ef5e7ef8f52db5b3f0fa6dafe11525
-
SHA512
a120649d06ece2b4224d2f73710e488a73441ff257b484930e8a9b704356bf3b91847fbbfe9a93a522c0bf018e459e2e4841e874f07ba304569214202086d90f
Malware Config
Signatures
-
Executes dropped EXE 18 IoCs
Processes:
Station.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exepid process 1148 Station.exe 2392 Station.exe 1284 Station.exe 2296 Station.exe 2508 Station.exe 372 Station.exe 356 Station.exe 3956 Station.exe 2980 Station.exe 1932 Station.exe 3924 Station.exe 3180 Station.exe 780 Station.exe 1728 Station.exe 1004 Station.exe 3924 Station.exe 3636 Station.exe 4188 Station.exe -
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Station.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Station.exe -
Loads dropped DLL 43 IoCs
Processes:
Station-Setup.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exepid process 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 1148 Station.exe 2392 Station.exe 1284 Station.exe 2296 Station.exe 2392 Station.exe 2392 Station.exe 2392 Station.exe 2508 Station.exe 2296 Station.exe 2296 Station.exe 2296 Station.exe 2296 Station.exe 372 Station.exe 356 Station.exe 3956 Station.exe 2980 Station.exe 356 Station.exe 356 Station.exe 356 Station.exe 2296 Station.exe 2980 Station.exe 2980 Station.exe 2980 Station.exe 2980 Station.exe 1932 Station.exe 3924 Station.exe 3180 Station.exe 780 Station.exe 1004 Station.exe 2980 Station.exe 3924 Station.exe 3636 Station.exe 1004 Station.exe 4188 Station.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Station = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\station-desktop-app\\Station.exe\"" reg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 35 freegeoip.app 36 freegeoip.app 42 freegeoip.app -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Station.exeStation.exeStation.exeStation.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Station.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Station.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Station.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Station.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Station.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Station.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Station.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Station.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Station.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Station.exe -
Modifies registry key 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Station-Setup.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exeStation.exepid process 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 2536 Station-Setup.exe 1284 Station.exe 1284 Station.exe 2296 Station.exe 2296 Station.exe 372 Station.exe 372 Station.exe 3956 Station.exe 3956 Station.exe 2980 Station.exe 2980 Station.exe 1932 Station.exe 1932 Station.exe 3924 Station.exe 3924 Station.exe 3180 Station.exe 3180 Station.exe 780 Station.exe 780 Station.exe 1004 Station.exe 1004 Station.exe 3636 Station.exe 3636 Station.exe 4188 Station.exe 4188 Station.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Station-Setup.exedescription pid process Token: SeSecurityPrivilege 2536 Station-Setup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Station.exeStation.exedescription pid process target process PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 2392 1148 Station.exe Station.exe PID 1148 wrote to memory of 1284 1148 Station.exe Station.exe PID 1148 wrote to memory of 1284 1148 Station.exe Station.exe PID 1148 wrote to memory of 2296 1148 Station.exe Station.exe PID 1148 wrote to memory of 2296 1148 Station.exe Station.exe PID 1148 wrote to memory of 372 1148 Station.exe Station.exe PID 1148 wrote to memory of 372 1148 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe PID 2508 wrote to memory of 356 2508 Station.exe Station.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Station-Setup.exe"C:\Users\Admin\AppData\Local\Temp\Station-Setup.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7343688803548307770 --mojo-platform-channel-handle=1596 --ignored=" --type=renderer " /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=utility --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --service-request-channel-token=3838399110660564072 --mojo-platform-channel-handle=1824 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=7760481178758236776 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --node-integration --webview-tag --no-sandbox --no-zygote --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=16768342018243442163 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Station2⤵
- Modifies registry key
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Station /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe\"" /f2⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --no-sandbox --no-zygote --native-window-open --preload="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar\preload.js" --background-color=#fff --guest-instance-id=3 --enable-blink-features --disable-blink-features --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=2424360375677426740 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --no-sandbox --no-zygote --native-window-open --preload="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar\preload.js" --background-color=#fff --guest-instance-id=3 --enable-blink-features --disable-blink-features --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=2660459409146865498 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2588 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --no-sandbox --no-zygote --native-window-open --preload="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar\preload.js" --background-color=#fff --guest-instance-id=4 --enable-blink-features --disable-blink-features --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=2699517225581499384 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --no-sandbox --no-zygote --native-window-open --preload="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar\preload.js" --background-color=#fff --guest-instance-id=4 --enable-blink-features --disable-blink-features --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=17394230476231577232 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --no-sandbox --no-zygote --native-window-open --preload="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar\preload.js" --background-color=#fff --guest-instance-id=4 --enable-blink-features --disable-blink-features --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=6746327907874589195 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=7523431776433985087 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1588,1967049118990455358,8881504801633221227,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15833257302097194705 --mojo-platform-channel-handle=3016 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1588,12193938439533797651,10205541216255883278,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=2342639833951067390 --mojo-platform-channel-handle=1596 --ignored=" --type=renderer " /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=utility --field-trial-handle=1588,12193938439533797651,10205541216255883278,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --service-request-channel-token=2852628361988077216 --mojo-platform-channel-handle=1804 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,12193938439533797651,10205541216255883278,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=3963893702298464259 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=renderer --field-trial-handle=1588,12193938439533797651,10205541216255883278,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --standard-schemes=station,chrome-extension --secure-schemes=chrome-extension --bypasscsp-schemes=chrome-extension --cors-schemes --fetch-schemes --service-worker-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asar" --node-integration --webview-tag --no-sandbox --no-zygote --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=12624245861243993271 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1632 /prefetch:12⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Station2⤵
- Modifies registry key
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe"C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exe" --type=gpu-process --field-trial-handle=1588,12193938439533797651,10205541216255883278,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADoAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=7909902982515099199 --mojo-platform-channel-handle=2408 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\D3DCompiler_47.dllMD5
fea40e5b591127ae3b065389d058a445
SHA1621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA2564b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
SHA512d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\Station.exeMD5
4cbc5d8ad8c7d8c1ae6db9a30bfe313b
SHA1572c39f6f6d4581841def3676dd9b8e2fc51de86
SHA25614295d769284e71e666ce46ad53aef39c4eb34b6015544458184d19b0855376f
SHA51243260aa06f49b5f387d5c521d87b33828cf4f03f646be2508a69a604678564a0b9ebb742f98acdf137e535ad478076f3d90a042fa1020423d4867084d894448a
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\chrome_100_percent.pakMD5
c56bc01c88f2fd186ae22f10b1bd5900
SHA1b000e68ccd919010eff8c2e114b7d1b6e702d997
SHA256d8cbc2234f40b49437a5876bb008b6b43afdf92391dec3f0739be98e448ab671
SHA51246f9158e0f06a4e415b95a7dabe88cc4f3eecc235cdaf9d744caf4de5e665ae91599e3c2feea0860e9f6eeb2eea45fe4e57542fae95ed9110d44624513de3aa0
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\chrome_200_percent.pakMD5
9662c1f572ef83f070d2354b0275ec60
SHA104ce905a95a1c3b8521a17ac9f57503e7aa3eac9
SHA25655dd419a1cecca86665ba5e6184d6b58edf714d652e67c5220dd3b407d99afa8
SHA512b1d34d58f5079b1db9764bce2787969113ac7cb1b83dbc3ebce8c9c287af372a639611ba11246a088243e2098dbd1d6ad51341eff2a57a995868bb0db94a3167
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\icudtl.datMD5
9e8b247aa7a609e6632518ecd6634fc0
SHA1cc43315bec76167be7dfbb7dd0b6d61974204d6c
SHA25618acc07d9ca59b1e599343b022a9e602a0a0c152866f7e5dce1fedd2dbcd33a0
SHA5127a9590f410c14886317d7cdae606b50b4a0355061e251aa3bcd3e0c614438298e839ff116553089116423e9bc98c131f35796478517d88a180a5a2d08ff7fa5f
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\locales\en-US.pakMD5
ce30d32061b772148cbc966915291edc
SHA14c5edaed4f3ba6e10443f344e757c26f7ceb4ce9
SHA25688a07be1329cfde3486dd0376de77e289468a750273970aeae6ad4468c0969f4
SHA512720fa132a3362ea4f5ea10f30c4996378d1f196210cef13c38579dbacc1f11e55d6dfdaa3aa0a6a574670a962f6e2910a2d66a64a1e7e1d6466b20529f5652cd
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\natives_blob.binMD5
1582ffe1b8cb37438bc22edee6cd0a90
SHA101af249f33b2e5ffba18ba8f7cd76f2ee0e5f425
SHA25602586eeaf4ce40d1b34310d885e34fb63e8e9f155fcedbd796536735907cbe80
SHA5128c66ba4ef15fea573c29f0f6977e290b8fd72f4c8833f31a9b0ef4285f5493e9b27daf3a02c352ed12eadce36cda933d9d97576bfa4dcbbcc04294e73ad9ebfc
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources.pakMD5
95b94a5784a8b31b3dfb56ed309510cb
SHA185e290c41d4be9c0d591404b281dc3931bd78c0f
SHA25643aa558648917a11fde82e73d9f1878d500098196e675ce2915c26361a05e8d5
SHA51286ebe9904050d8653a029b52effd977a42e727ca40e62c7d2ceed4685dfaf762678a3402c16d90bb0a05357eebb988614964fce6ae19a67636f6cc3f8578bac4
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\.env.exampleMD5
f5e84418e2d1a3f2b8c0af9120743763
SHA19222cabdebdd15a5ac99a45645317fbb1f407d7d
SHA25656e082fa869cc958663de48d69b04b10e31f052a5748117a3b876b42f676a58b
SHA512c28428cacc64eb12a92b3d39067d9076747981ca1f4b33e9b8962e450136ded4e59021b8932f4b5eb67bba1f64a87a8f8f56ceb168eec44b6575fbb94bfb85b0
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\.env.productionMD5
bd3459f79f44d1a2c60806894c38ed15
SHA15535ad89574721ce9caf1b3f922c3e11fd1161a9
SHA2568662a57760a262d7458bdecb6355193e3c25ada96b72fbc8389b11b7e721f995
SHA51261898b9ea2fea638621d83bb210616e500f45951204226b8ab4d93a4d2b972e9c20f03b0bd9455a17bbcd942bda9d8f1ad1a2976a454721cc4b4714432fb7155
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\resources\app.asarMD5
c79ce4958528109f3b1d579fdd5bf218
SHA1fa84b80afb469a9a8c12c65532bc8fc26881328f
SHA2563180c6cc4a82b2eb0ef0af7b2cb35304c0593029f63dc03ec9b02f0a037f9856
SHA51235cdbc09739987c564d2981ae95689aae50f87b0c5f2d3c87c1ba254a8a6a78115b5c493e857a1d07ffcadd40abe3dd4c7006b87c03a2d3245d6e7abc2a18eca
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libegl.dllMD5
1a76c3311b6f88a7aeafaae4a4e2e7a8
SHA10f57109f7c13b1857dd693344967ab3e67f87181
SHA256733e0f790eae21e61c38fdd4f790050d11eed5b5057ccf7bbbb572d5440607d1
SHA512c6daaaacfadb3d662fa1d12799c4bd1f6817df48df44dc9fdcf3c2b185d3e6898f4a6fce7b59a27539d206f5316b1fa0620aec4efb1db7a07893e8a1ede5846f
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libglesv2.dllMD5
1ce2b05e35cd252c0659d56a662db583
SHA11bb3e8becfa0ed3fc506f331a3bf617b2e1d7149
SHA256e66d9edeed08bfa60e3499c32c8c7f70b3bf237849ebd1c069305f83e1427752
SHA512096f2b3ef2f8f7a7252d8ea442092d1042cbff4112d76dcca0c8e54232f7b5119fea4a894236331b49a1f55a7da37a039120b45ff53a042f08bb9140cfc391fb
-
C:\Users\Admin\AppData\Local\Programs\station-desktop-app\v8_context_snapshot.binMD5
791e836529dc39d99117742c225a537d
SHA18d035c2446758ec65c41e48d3671004527a55772
SHA2566baadc6adcd5e51d549a4d2f07b619d2a5b97f99a372f33efd3c84d2a369c747
SHA512afca91bad91c359af1febc86e5e0cf16b0b2549ccdb6ae1d733f9d66e0d1daa4a3b96273d7888835dfe820722ca8d7e38b1085011dd7d6851a3198cdc18bbac2
-
C:\Users\Admin\AppData\Roaming\Station\log.logMD5
307f3bba0e33a1f63225d990d52a8fe1
SHA1aa46056c4e5b68162b630dd2735dc57cb7c246a9
SHA25640dc61309aae4257b31ef7fa00b53b422c48a792545038a717f258b24c13b418
SHA51258dab6e941040993264c888d5ff650d95a1d65e42a54859a3eaed2376e2fd7d8b04d3b0815f1e2454225e0d14c3fb8fac54dbb2d1f795ed788470edb35ff87c0
-
C:\Users\Admin\AppData\Roaming\Stationv2\Code Cache\js\indexMD5
54cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Roaming\Stationv2\Code Cache\js\index-dir\the-real-indexMD5
c052045f4a6ba8b47c98a3286b97e493
SHA169ee274ce85e04985f580e72ce47c5b3eeddfdd2
SHA256f675783d90cb0e068abab12e3857addce6061cc6f52665bed4225d5815728adf
SHA512844f51fe6be1ece93d61829afcc8c330ced5df89604b0d49d86db6db607a6f3d5ef0e0da08385f77d74f0be32cf0771a64df165a6439a17d426c391008e28e8f
-
C:\Users\Admin\AppData\Roaming\Stationv2\Local Storage\leveldb\LOGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\Stationv2\Network Persistent StateMD5
2800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Roaming\Stationv2\db\station.dbMD5
cbcfafe14dffa57623e2861f80cd6024
SHA1e579b2031f7f2228bbe815ad6b2e2cf1f5bff3cb
SHA25669fda08540215f626b33b98e19bd83535556898f9f194648d50f48e5c8f41c6c
SHA512e898bd81b9a89b2fa802ae2063b30cbb36e4628ae2b7e75c3af7a5822acbd8da42c113baa8e441f61da78fb3c50bb53c12386c68c8f7b858bb61a68a5921292e
-
C:\Users\Admin\AppData\Roaming\Stationv2\db\station.db-walMD5
7f99dcbbff6f3a04a75e2857a788aa6c
SHA164e70301892ffa2f0ca2caa5ddcfb415aa23d3c3
SHA25614c0627b17ec3ddbb18bde6c2948cd6a9a4cb3f57f5a02a2379e48e440266c7a
SHA5121402a0fe522707d40c7a638cbd89325c5974f458bd35d29d460d68980bb4623a1528eb9baa306f791c8b58def7e6a3ae696b62c6337c352aa2ec4a0235214f84
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\d3dcompiler_47.dllMD5
fea40e5b591127ae3b065389d058a445
SHA1621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA2564b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
SHA512d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\d3dcompiler_47.dllMD5
fea40e5b591127ae3b065389d058a445
SHA1621fa52fb488271c25c10c646d67e7ce5f42d4f8
SHA2564b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
SHA512d2412b701d89e2762c72dd99a48283d601dd4311e3731d690cc2ab6cced20994fa67bf3fea4920291fc407cd946e20bdc85836e6786766a1b98a86febaa0e3d9
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\ffmpeg.dllMD5
0173d01bdcb90a5027ca96d633686fd3
SHA19e008814f94c3abf5a7ba672864f50a4a2a288d9
SHA256f31b6e70365d1812578c6f96831fbec800ef7420c92566638252193bd7c7e4ff
SHA51247665ce82bed00eff30dcff8a0e78b2badddd956bdd48be48c1cad75676af25e4abfd513ccba282f74dbf9e659c4fb7502da6876048da1fb8d875ab12c5d9b99
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libEGL.dllMD5
1a76c3311b6f88a7aeafaae4a4e2e7a8
SHA10f57109f7c13b1857dd693344967ab3e67f87181
SHA256733e0f790eae21e61c38fdd4f790050d11eed5b5057ccf7bbbb572d5440607d1
SHA512c6daaaacfadb3d662fa1d12799c4bd1f6817df48df44dc9fdcf3c2b185d3e6898f4a6fce7b59a27539d206f5316b1fa0620aec4efb1db7a07893e8a1ede5846f
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libEGL.dllMD5
1a76c3311b6f88a7aeafaae4a4e2e7a8
SHA10f57109f7c13b1857dd693344967ab3e67f87181
SHA256733e0f790eae21e61c38fdd4f790050d11eed5b5057ccf7bbbb572d5440607d1
SHA512c6daaaacfadb3d662fa1d12799c4bd1f6817df48df44dc9fdcf3c2b185d3e6898f4a6fce7b59a27539d206f5316b1fa0620aec4efb1db7a07893e8a1ede5846f
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libGLESv2.dllMD5
1ce2b05e35cd252c0659d56a662db583
SHA11bb3e8becfa0ed3fc506f331a3bf617b2e1d7149
SHA256e66d9edeed08bfa60e3499c32c8c7f70b3bf237849ebd1c069305f83e1427752
SHA512096f2b3ef2f8f7a7252d8ea442092d1042cbff4112d76dcca0c8e54232f7b5119fea4a894236331b49a1f55a7da37a039120b45ff53a042f08bb9140cfc391fb
-
\Users\Admin\AppData\Local\Programs\station-desktop-app\swiftshader\libGLESv2.dllMD5
1ce2b05e35cd252c0659d56a662db583
SHA11bb3e8becfa0ed3fc506f331a3bf617b2e1d7149
SHA256e66d9edeed08bfa60e3499c32c8c7f70b3bf237849ebd1c069305f83e1427752
SHA512096f2b3ef2f8f7a7252d8ea442092d1042cbff4112d76dcca0c8e54232f7b5119fea4a894236331b49a1f55a7da37a039120b45ff53a042f08bb9140cfc391fb
-
\Users\Admin\AppData\Local\Temp\07213263-48d3-413a-8b77-13911dce3236.tmp.nodeMD5
b8aafe143774bf4f0d6c6634d3ac3404
SHA19be20afe83497faed88da5ac6084dd5c876b518c
SHA256e66f80f20838d82176b9aaab6d31e2e17121c15c1943027ee56981c85f550832
SHA512b25b2efb61a2b5a3730e20f5453253c94581568b8c0bd746b292c1b57fdd49880340c2c1b6c58b417a2d7d93115120726408cd3bd234907e2158259d0c06229e
-
\Users\Admin\AppData\Local\Temp\0b110715-34fd-489a-a70d-cab8f9f88628.tmp.nodeMD5
3bca3a480cb2ec13ec22e2749e1e3c77
SHA19f63f9e31f98ecefa0fca07768b187f84d3f7169
SHA256e01b14db88d119f7b034941768ba876da0fa6d867fb3281f1e7c57c5968bfa6b
SHA51228442162914500109b54d5206d19532ecb98000bc92556dd9dc2867ce7d5842b36c6f7733d89ea0448757330aea5211f0d04a848f4d34018ed0e6536c6c1a35e
-
\Users\Admin\AppData\Local\Temp\3a66651f-a8c3-417b-b922-fa2ac7882530.tmp.nodeMD5
a8f34346de08c2afed1f4332f961c5b4
SHA1924db28b733f45253a367e52e046f5664c055ab6
SHA2566a76ba909aafcac10f64fa6375cc893970c35d0b94148706f4e1206b33baf0ae
SHA512d0ad30ba8e0c1368a01c94aeff1343c6d3828ccb729393b033d4d94e9b3917deb287ba61b570e27f7b6c3170ad40c765e3a654ccac71d4250e11d8b3613ff881
-
\Users\Admin\AppData\Local\Temp\5a8fddfd-7030-4295-bf0e-81c553ccdc1a.tmp.nodeMD5
e8ee0d19c4c20f399d60ec635610fd64
SHA13f8d018830fbea3ad0e59cccc2154996d84a8b2d
SHA25603ae26ac0a2f12d11b040aa40dba9d3d8b0bef054394ee6b0c415601b664a2bc
SHA5124b6fbdf7b6af0bc296e9bfc2d93dd6cdff11e18974db3a97a55a03bea12b3884c2dec9e95599f4ba58ee026419015adb3617386d5c6b513f16d0385da9d110df
-
\Users\Admin\AppData\Local\Temp\5e6b9971-5676-467f-8c94-749214650b1d.tmp.nodeMD5
3bca3a480cb2ec13ec22e2749e1e3c77
SHA19f63f9e31f98ecefa0fca07768b187f84d3f7169
SHA256e01b14db88d119f7b034941768ba876da0fa6d867fb3281f1e7c57c5968bfa6b
SHA51228442162914500109b54d5206d19532ecb98000bc92556dd9dc2867ce7d5842b36c6f7733d89ea0448757330aea5211f0d04a848f4d34018ed0e6536c6c1a35e
-
\Users\Admin\AppData\Local\Temp\7f74dd0c-c866-4c08-b7ae-a8960428da1e.tmp.nodeMD5
a8f34346de08c2afed1f4332f961c5b4
SHA1924db28b733f45253a367e52e046f5664c055ab6
SHA2566a76ba909aafcac10f64fa6375cc893970c35d0b94148706f4e1206b33baf0ae
SHA512d0ad30ba8e0c1368a01c94aeff1343c6d3828ccb729393b033d4d94e9b3917deb287ba61b570e27f7b6c3170ad40c765e3a654ccac71d4250e11d8b3613ff881
-
\Users\Admin\AppData\Local\Temp\82af15ef-f34c-4577-955b-1721731cddfb.tmp.nodeMD5
95f9559b76e5dc773763c8faa8b3bc33
SHA1f15fd746dfb5643b1e66e2a38543f489730f7809
SHA25621e7c7a7e677a000984692d13784f25903bbc50b3ce07105b28014ae74b9e720
SHA51245ea775a7730aed061e188c9f4a96f16a14124a853d461ccd12ae28348224f74ff20f2c478d324ab959c60a8c05b423e0024307bbbee5e6d22a54ce54bee9cd3
-
\Users\Admin\AppData\Local\Temp\bb409e2b-deb6-4ff8-82b7-56e56f36399a.tmp.nodeMD5
e8ee0d19c4c20f399d60ec635610fd64
SHA13f8d018830fbea3ad0e59cccc2154996d84a8b2d
SHA25603ae26ac0a2f12d11b040aa40dba9d3d8b0bef054394ee6b0c415601b664a2bc
SHA5124b6fbdf7b6af0bc296e9bfc2d93dd6cdff11e18974db3a97a55a03bea12b3884c2dec9e95599f4ba58ee026419015adb3617386d5c6b513f16d0385da9d110df
-
\Users\Admin\AppData\Local\Temp\cb868524-0882-47de-83fb-31f40c9ff5b2.tmp.nodeMD5
95f9559b76e5dc773763c8faa8b3bc33
SHA1f15fd746dfb5643b1e66e2a38543f489730f7809
SHA25621e7c7a7e677a000984692d13784f25903bbc50b3ce07105b28014ae74b9e720
SHA51245ea775a7730aed061e188c9f4a96f16a14124a853d461ccd12ae28348224f74ff20f2c478d324ab959c60a8c05b423e0024307bbbee5e6d22a54ce54bee9cd3
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\SpiderBanner.dllMD5
17309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\StdUtils.dllMD5
c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\System.dllMD5
0d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\WinShell.dllMD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\WinShell.dllMD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\WinShell.dllMD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\WinShell.dllMD5
1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA10b9519763be6625bd5abce175dcc59c96d100d4c
SHA2569be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA5127acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nsi3E6D.tmp\nsis7z.dllMD5
80e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
-
memory/356-187-0x0000000000000000-mapping.dmp
-
memory/356-191-0x0000020D42200000-0x0000020D42202000-memory.dmpFilesize
8KB
-
memory/356-186-0x0000020D42275000-0x0000020D42276000-memory.dmpFilesize
4KB
-
memory/356-201-0x0000020D42200000-0x0000020D42202000-memory.dmpFilesize
8KB
-
memory/356-190-0x0000020D42200000-0x0000020D42202000-memory.dmpFilesize
8KB
-
memory/356-203-0x0000020D42200000-0x0000020D42202000-memory.dmpFilesize
8KB
-
memory/372-180-0x00000231111F0000-0x00000231111F2000-memory.dmpFilesize
8KB
-
memory/372-179-0x00000231111F0000-0x00000231111F2000-memory.dmpFilesize
8KB
-
memory/372-182-0x00000231111F0000-0x00000231111F2000-memory.dmpFilesize
8KB
-
memory/372-183-0x00000231111F0000-0x00000231111F2000-memory.dmpFilesize
8KB
-
memory/372-177-0x0000000000000000-mapping.dmp
-
memory/780-248-0x0000027C60310000-0x0000027C60312000-memory.dmpFilesize
8KB
-
memory/780-227-0x0000000000000000-mapping.dmp
-
memory/780-250-0x0000027C60310000-0x0000027C60312000-memory.dmpFilesize
8KB
-
memory/780-240-0x0000000000000000-mapping.dmp
-
memory/780-243-0x0000027C60310000-0x0000027C60312000-memory.dmpFilesize
8KB
-
memory/780-242-0x0000027C60310000-0x0000027C60312000-memory.dmpFilesize
8KB
-
memory/1004-252-0x000001A822C60000-0x000001A822C62000-memory.dmpFilesize
8KB
-
memory/1004-245-0x0000000000000000-mapping.dmp
-
memory/1004-253-0x000001A822C60000-0x000001A822C62000-memory.dmpFilesize
8KB
-
memory/1004-249-0x000001A822C60000-0x000001A822C62000-memory.dmpFilesize
8KB
-
memory/1004-247-0x000001A822C60000-0x000001A822C62000-memory.dmpFilesize
8KB
-
memory/1004-251-0x000001A822C60000-0x000001A822C62000-memory.dmpFilesize
8KB
-
memory/1148-126-0x000002D43F5B0000-0x000002D43F5B2000-memory.dmpFilesize
8KB
-
memory/1148-125-0x000002D43F5B0000-0x000002D43F5B2000-memory.dmpFilesize
8KB
-
memory/1148-137-0x000002D43F5B0000-0x000002D43F5B2000-memory.dmpFilesize
8KB
-
memory/1168-210-0x0000000000000000-mapping.dmp
-
memory/1284-150-0x000002C1B9F70000-0x000002C1B9F72000-memory.dmpFilesize
8KB
-
memory/1284-146-0x0000000000000000-mapping.dmp
-
memory/1284-151-0x000002C1B9F70000-0x000002C1B9F72000-memory.dmpFilesize
8KB
-
memory/1576-211-0x0000000000000000-mapping.dmp
-
memory/1728-246-0x000001C7975A0000-0x000001C7975A2000-memory.dmpFilesize
8KB
-
memory/1728-244-0x000001C7975A0000-0x000001C7975A2000-memory.dmpFilesize
8KB
-
memory/1728-241-0x0000000000000000-mapping.dmp
-
memory/1932-223-0x000001B934F50000-0x000001B934F52000-memory.dmpFilesize
8KB
-
memory/1932-222-0x0000000000000000-mapping.dmp
-
memory/1932-224-0x000001B934F50000-0x000001B934F52000-memory.dmpFilesize
8KB
-
memory/1932-225-0x000001B934F50000-0x000001B934F52000-memory.dmpFilesize
8KB
-
memory/1932-226-0x000001B934F50000-0x000001B934F52000-memory.dmpFilesize
8KB
-
memory/2296-152-0x0000000000000000-mapping.dmp
-
memory/2296-163-0x0000015F23B20000-0x0000015F23B22000-memory.dmpFilesize
8KB
-
memory/2296-160-0x0000015F23B20000-0x0000015F23B22000-memory.dmpFilesize
8KB
-
memory/2296-156-0x0000015F23B20000-0x0000015F23B22000-memory.dmpFilesize
8KB
-
memory/2296-155-0x0000015F23B20000-0x0000015F23B22000-memory.dmpFilesize
8KB
-
memory/2392-159-0x000002055E580000-0x000002055E582000-memory.dmpFilesize
8KB
-
memory/2392-147-0x000002055E580000-0x000002055E582000-memory.dmpFilesize
8KB
-
memory/2392-142-0x0000000000000000-mapping.dmp
-
memory/2392-145-0x000002055E580000-0x000002055E582000-memory.dmpFilesize
8KB
-
memory/2392-158-0x000002055E580000-0x000002055E582000-memory.dmpFilesize
8KB
-
memory/2392-144-0x00007FFA96710000-0x00007FFA96711000-memory.dmpFilesize
4KB
-
memory/2392-141-0x000002055E5FB000-0x000002055E5FC000-memory.dmpFilesize
4KB
-
memory/2508-172-0x000001B65B1D0000-0x000001B65B1D2000-memory.dmpFilesize
8KB
-
memory/2508-169-0x000001B65B1D0000-0x000001B65B1D2000-memory.dmpFilesize
8KB
-
memory/2508-170-0x000001B65B1D0000-0x000001B65B1D2000-memory.dmpFilesize
8KB
-
memory/2980-202-0x000001D1376D0000-0x000001D1376D2000-memory.dmpFilesize
8KB
-
memory/2980-208-0x000001D1376D0000-0x000001D1376D2000-memory.dmpFilesize
8KB
-
memory/2980-209-0x000001D1376D0000-0x000001D1376D2000-memory.dmpFilesize
8KB
-
memory/2980-197-0x0000000000000000-mapping.dmp
-
memory/2980-200-0x000001D1376D0000-0x000001D1376D2000-memory.dmpFilesize
8KB
-
memory/3180-232-0x000002BD61B10000-0x000002BD61B12000-memory.dmpFilesize
8KB
-
memory/3180-238-0x000002BD61B10000-0x000002BD61B12000-memory.dmpFilesize
8KB
-
memory/3180-237-0x000002BD61B10000-0x000002BD61B12000-memory.dmpFilesize
8KB
-
memory/3180-236-0x000002BD61B10000-0x000002BD61B12000-memory.dmpFilesize
8KB
-
memory/3180-233-0x000002BD61B10000-0x000002BD61B12000-memory.dmpFilesize
8KB
-
memory/3180-229-0x0000000000000000-mapping.dmp
-
memory/3636-278-0x0000000000000000-mapping.dmp
-
memory/3924-234-0x0000021F0FE10000-0x0000021F0FE12000-memory.dmpFilesize
8KB
-
memory/3924-258-0x000001AE000E0000-0x000001AE000E2000-memory.dmpFilesize
8KB
-
memory/3924-235-0x0000021F0FE10000-0x0000021F0FE12000-memory.dmpFilesize
8KB
-
memory/3924-228-0x0000000000000000-mapping.dmp
-
memory/3924-259-0x00007FFA985A0000-0x00007FFA985A1000-memory.dmpFilesize
4KB
-
memory/3924-231-0x0000021F0FE10000-0x0000021F0FE12000-memory.dmpFilesize
8KB
-
memory/3924-230-0x0000021F0FE10000-0x0000021F0FE12000-memory.dmpFilesize
8KB
-
memory/3924-255-0x0000000000000000-mapping.dmp
-
memory/3924-254-0x000001AE58B71000-0x000001AE58B72000-memory.dmpFilesize
4KB
-
memory/3924-257-0x000001AE000E0000-0x000001AE000E2000-memory.dmpFilesize
8KB
-
memory/3956-195-0x0000020FCC910000-0x0000020FCC912000-memory.dmpFilesize
8KB
-
memory/3956-192-0x0000000000000000-mapping.dmp
-
memory/3956-196-0x0000020FCC910000-0x0000020FCC912000-memory.dmpFilesize
8KB
-
memory/4188-285-0x0000000000000000-mapping.dmp