1c04ed11ce29fcfc3186144f0f907b70296132eb3db89044463cb14b97eb87d0

Analysis

max time kernel
150s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
23/02/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Size 36.6MB
Sample240223-pn1fysff6w
SHA256 1c04ed11ce29fcfc3186144f0f907b70296132eb3db89044463cb14b97eb87d0
MD5 77f098ad333889de410f665e4f9a8702
SHA1 6b8e8abe6a374f02a88058961f180818cfcf7670
SHA512 711326a015e02dd4789023fbefeaedc769d0ef33668497c107cb3c512a2acc2fa312d3cd5011d3a510ccb87ce236bfe0fc1d4b253b332c2e6ecd9ff6e7c6af9c
SSDEEP 786432:2KQbhz5LGoCjmcE/ppyp22HaxvPAXkFeOLV61DDKr0wlqDIgtQ:2FLCjmphS2iSvfJLQxKr0wlw2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1084	pollymc.exe

Loads dropped DLL 54 IoCs

pid	Process
3112	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
3112	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
3112	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe
1084	pollymc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3608	icacls.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
588	TaskKill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133531651392655057"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\curseforge\shell	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\curseforge\shell\open	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\curseforge\shell\open\command\ = "\"C:\\Users\\Admin\\Desktop\\New folder\\PollyMC\\pollymc.exe\" \"%1\""	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\curseforge	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\curseforge\URL Protocol	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Key created	\REGISTRY\USER\S-1-5-21-1101742937-4171729779-750941522-1000_Classes\curseforge\shell\open\command	PollyMC-Windows-MinGW-w64-Setup-8.0.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1084	pollymc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
832	chrome.exe
832	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1084	pollymc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	TaskKill.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe
Token: SeCreatePagefilePrivilege	832	chrome.exe
Token: SeShutdownPrivilege	832	chrome.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1084	pollymc.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe
832	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 588	3112	PollyMC-Windows-MinGW-w64-Setup-8.0.exe	78
PID 3112 wrote to memory of 588	3112	PollyMC-Windows-MinGW-w64-Setup-8.0.exe	78
PID 3112 wrote to memory of 588	3112	PollyMC-Windows-MinGW-w64-Setup-8.0.exe	78
PID 3112 wrote to memory of 1084	3112	PollyMC-Windows-MinGW-w64-Setup-8.0.exe	82
PID 3112 wrote to memory of 1084	3112	PollyMC-Windows-MinGW-w64-Setup-8.0.exe	82
PID 1084 wrote to memory of 4196	1084	pollymc.exe	83
PID 1084 wrote to memory of 4196	1084	pollymc.exe	83
PID 1084 wrote to memory of 2192	1084	pollymc.exe	84
PID 1084 wrote to memory of 2192	1084	pollymc.exe	84
PID 1084 wrote to memory of 1760	1084	pollymc.exe	85
PID 1084 wrote to memory of 1760	1084	pollymc.exe	85
PID 1084 wrote to memory of 4844	1084	pollymc.exe	86
PID 1084 wrote to memory of 4844	1084	pollymc.exe	86
PID 2192 wrote to memory of 3608	2192	javaw.exe	87
PID 2192 wrote to memory of 3608	2192	javaw.exe	87
PID 832 wrote to memory of 2576	832	chrome.exe	92
PID 832 wrote to memory of 2576	832	chrome.exe	92
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 5100	832	chrome.exe	93
PID 832 wrote to memory of 928	832	chrome.exe	97
PID 832 wrote to memory of 928	832	chrome.exe	97
PID 832 wrote to memory of 3668	832	chrome.exe	94
PID 832 wrote to memory of 3668	832	chrome.exe	94
PID 832 wrote to memory of 3668	832	chrome.exe	94
PID 832 wrote to memory of 3668	832	chrome.exe	94
PID 832 wrote to memory of 3668	832	chrome.exe	94
PID 832 wrote to memory of 3668	832	chrome.exe	94
PID 832 wrote to memory of 3668	832	chrome.exe	94

C:\Users\Admin\AppData\Local\Temp\PollyMC-Windows-MinGW-w64-Setup-8.0.exe
"C:\Users\Admin\AppData\Local\Temp\PollyMC-Windows-MinGW-w64-Setup-8.0.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Windows\SysWOW64\TaskKill.exe
  TaskKill /IM pollymc.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:588
- C:\Users\Admin\Desktop\New folder\PollyMC\pollymc.exe
  "C:\Users\Admin\Desktop\New folder\PollyMC\pollymc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:/Users/Admin/Desktop/New folder/PollyMC/jars/JavaCheck.jar"
    3⤵
    PID:4196
- - C:\Program Files\Java\jdk-1.8\bin\javaw.exe
    "C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -jar "C:/Users/Admin/Desktop/New folder/PollyMC/jars/JavaCheck.jar"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      4⤵
      Modifies file permissions
      PID:3608
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
    javaw -jar "C:/Users/Admin/Desktop/New folder/PollyMC/jars/JavaCheck.jar"
    3⤵
    PID:1760
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
    "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar "C:/Users/Admin/Desktop/New folder/PollyMC/jars/JavaCheck.jar"
    3⤵
    PID:4844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbdc99758,0x7ffcbdc99768,0x7ffcbdc99778
  2⤵
  PID:2576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:2
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:1
  2⤵
  PID:332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:8
  2⤵
  PID:928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4552 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5024 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3900 --field-trial-handle=1796,i,2280156615330680944,16605287448096327567,131072 /prefetch:1
  2⤵
  PID:2920

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0daffdd0-d589-4ab3-837b-6a3aac4e5e0a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0daffdd0-d589-4ab3-837b-6a3aac4e5e0a.tmp
Size 256KB
SHA256 66fdf09fc73bd8e6e3edf6676814bd1490ebe83157f2c0408a20521ce72db95d
MD5 8473bc7e0adcfe53d74b33d3faa1c625
SHA1 fd7905132b0f5c7127dd5678fe18ff7bd48c5d45
SHA512 3793822d451c54d85e6309425c6bfba6e49a2c7b36f39aaa64b1ba9981a3faa709fef8d62e86de5eb339272c63084ab54aff31a2e5535e5c60adaffec117cb92
SSDEEP 6144:GIWdy5us5ZoWEaNoKZRTbAFTy2J6d7Yj3Ua9jHThM8fNHK9K5R:uYIQZy0oKZRTbAFTyiIsbUYHTqwNqo5R
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001
Size 195KB
SHA256 4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d
MD5 873734b55d4c7d35a177c8318b0caec7
SHA1 469b913b09ea5b55e60098c95120cc9b935ddb28
SHA512 24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308
SSDEEP 3072:MRN8HrBjMHqX6DekPCqS8MHliYH1xDd2+iHSRbBy0NaD7a9tAcKAlFftol/Y4H+O:oqyaLkPmrFiODU+8S3RNp4LAbCKPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 38f5406cbbb9ead596b6997143fa3f99c1642e730cc0db92ce1710099ee35428
MD5 1e26a7178e0d0f9b9b6477c933cbf51c
SHA1 b1e18338cf03138800340d82ce9fc97e0399183f
SHA512 f5f464e46e6d5f85cd5ea610dc4614277b294349ffdf23fdf8b81b7ee90145526722b0f42e46a554365cb196d47c9da2df0db5cf538e10046f92c2e74d5229e5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 371B
SHA256 0ebcd10e3ab54a4a680de01db5a50fe862cec0bcc7b83e3576fb717e3dcb8ad4
MD5 f164d837d459ca94d96a40cbd2d1e9de
SHA1 0689cec050c5c8df9f6964d112b792d80d106b16
SHA512 6a9b6cef7dce08aa7f77d491085632c88ed513b6387d09118d52affed228f28da01e2466a13260fdfdfc59661494478849741e41dda68e91d246461c5dcfb130
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 050567d62a88836ae1e4018ec82b9beb35bfe01d424e0dd75bfe5781b77dc8ee
MD5 3166edd6aac66fdb7136ed0f057e41c9
SHA1 17450dba261360995544b61710cf711266c710d4
SHA512 721d2a50cb2fa044c30fc1d04cfe14a3039f65a51d883d5c6103d5d423823b8af41bb64e2ca516aca1547922c72a3b965c1d0413105face12c961f54242bd67d
SSDEEP 192:duC5j+UQYza8syy+FZkG15DyAotjEsXtScPS:duC56yx315DyDtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 3b4cec612ee4574f40621e6173b712daf6ad86f1ad3bdd106ed3da2b4caa5d2c
MD5 5c5939b724fdec580041bb5cf54d3740
SHA1 267b5ab0553a76438a305e768bfe0e85b0bfcda0
SHA512 14a500fddefb2c58f422aa85a2f5a4f9fd1a69c79d5abdc623baea927abee6010975d38c35b6d07e97b5e2610ab7183aed6eaf4c0b9bfe5fa0670ea4e2b2e320
SSDEEP 192:duC5j+UQYza8syy+FSt5DyAotjEsXtScPS:duC56yxSDDyDtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 463ae2d333bc09968166df6b151079db8bd1f5dcc1de14749e3e44061285adff
MD5 5b941ee7b8e0d298709638b7736760d8
SHA1 c6217b2a09a1c37efa1a782c2e0cfd4140877e8b
SHA512 a275295df36590dff5a30fbf86167eff5aeb58c9a2149e358d018ed80086c625f7dafbc1039a9c859572b1f163e4d75260658c9bb9398b23b1b8d4d4eefa8f90
SSDEEP 384:NKXKLPLeFbXS71kXqKf/pUZNCgVLH2HfkRprUu9HG/6sucL:5LPLSM1kXqKf/pUZNCgVLH2HfUrUUGgg
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfADE4.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsfADE4.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfADE4.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfADE4.tmp\nsExec.dll
Size 7KB
SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
MD5 675c4948e1efc929edcabfe67148eddd
SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

pollymc.cfg

Path C:\Users\Admin\AppData\Roaming\PollyMC\pollymc.cfg
Size 138B
SHA256 4413e48dc99e87e3f466db9d73f3d748615fe702a89de93525c0a38b0ca9fa44
MD5 d0762f7cbbe8598689dd72a0e25f0722
SHA1 02c72f1a92351acc379693c33fa1d8f1d9756896
SHA512 978a7720fe37a33afddcd0ed0bfd5f6fea85fd533a36e7b13052beadb8d174b308788ceb5f7489093427028154e012960600c9386e1286bec1325da918ee779e
MD5 SHA1 SHA512

Submit Download

pollymc.cfg.lock

Path C:\Users\Admin\AppData\Roaming\PollyMC\pollymc.cfg.lock
Size 60B
SHA256 f144c90a9438d87e447ce0b36bb0e7f530d738b7ed40392299fd3afb51457100
MD5 8e75bb54bf6af4246dd2394ee1e8d14b
SHA1 4c9e47e37fc4a7c2b753260c1b4a717de80776b3
SHA512 61d6ca6b314d1b0b2499a05585bbcb6e9c37848462ce3e8dd6ed830f241b360225f542c3a49cdfc98b51879cdec05cd618ee0cabbd0803705d05e0d2eb12bf7c
MD5 SHA1 SHA512

Submit Download

pollymc.cfg.tIuFiM

Path C:\Users\Admin\AppData\Roaming\PollyMC\pollymc.cfg.tIuFiM
Size 30B
SHA256 9da99b49301ba83c33387e75d2028185562479e677b6afb110b4f8b098465807
MD5 a6dc16331f06bc5831e5ddc9799284ec
SHA1 d344f83d549df8c3e2c959182ba37f8c81d885a5
SHA512 43e498eab5c6f9b2f70c01e0abd4e63edb2651e498f267b53c7f62f2ef9c1eb68fa4783967fdba1880722a8bcd6e58065108f42773f0f47c04c9e54e809b1c14
MD5 SHA1 SHA512

Submit Download

Qt6Core.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Core.dll
Size 4.2MB
SHA256 a310758983d55ad1abba5cd275541e80935bcf9ad04bcd6d36db4542af8b88d6
MD5 8a2e6c6cc6b35797a98928b5f08aea4c
SHA1 c01eaa1744767ef6609bd137d2a172245985058f
SHA512 5eb2d653e270fbf7729a27469ac9c405a760df1692c3192389b4bab95a6c96c9e37db1106bf2aa376df66114d4c8b31a4672f78da6c49731116e6e3410d7ba3b
SSDEEP 98304:B7sLG9XS6+gruc8uCqHmT8OcNJENKFdu9CwJsv6tZev:k6esKKFdu9CwJsv6tZev
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Core.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Core.dll
Size 4.0MB
SHA256 ecd0641d1efcc2d60e3b25b37b0125d114d84589922442e2c901473db59026e1
MD5 64c13789039704f42acc277ad449b3b8
SHA1 c63f8936c59bb3d412afc0231754e3b39d3b8a8a
SHA512 609535ca24e2bfd0987ef230a02055300234c3a4760be4195389e98f6912bbced7951784dba57db7102bb36ff6400d049cbb87953d16fb707368ffdd2dc9ac13
SSDEEP 98304:B7sLG9XS6+gruc8uCqHmT8OcNJENKFdu9CwJsv6tZej:k6esKKFdu9CwJsv6tZej
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Core5Compat.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Core5Compat.dll
Size 408KB
SHA256 792cdcf3a9843bd46e1af141029e714464ce125a45b74582b5de1d7ef01801b5
MD5 ab88dd4c87ff60a81b698c5b194d0d92
SHA1 a5c114e642297ee477db5f38286d5e24eafe1920
SHA512 43089e7cd5bb983af01413d2774febfefebfc85cccdcdfe7097eedc8bb571c5b90ffb269a6c5e029b8db8aca96d32c2cf9c216211dfe762db5167e6e52f66f3c
SSDEEP 6144:BFjJvtY6xPc75VS4e4NSj85X4Spth8gGRywZgDfe51XtcQCDT0:FtY8ci4xjptGFyaQaHCDT0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Gui.dll
Size 4.0MB
SHA256 a38de1d04942eb7722c284b890a26402e7b2cb130038b7f8851d5faabb05e214
MD5 819293e4e3d236e8de4de58d3d6e5335
SHA1 6412954a51fcd0b84d1726b3d31a79046fb7a345
SHA512 72d13f039b122d456d42662db42169f370ce479e675ff5730ddb96a39c62d6ac94fb3c3553a08a427beefd21c716a04b49cbbaa5a9eb17601d693e6f4f4ce2b7
SSDEEP 98304:k4zvfLTx01VX+DZaitQ/rc6NT6+7RvnSd2Oanb76/mWs:EnX+deWyRLqa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Gui.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Gui.dll
Size 1.3MB
SHA256 81fc2ffdcfe2d99dac8a26a9d2038e3f142387f183f1dd042e46ee5c8ceefc60
MD5 6b55d5447953ccaf9d729957e94ea335
SHA1 c40cf59c7ad209f0dd827a16f3cf4d379c9f90b1
SHA512 ad3ebc580aa74262a793942e21693802c79ac75cd5d58e1fc72d499c60e11783ed6d8b8f444a92bb23d06c383ed41527a34b8f3c4c1e75e32993907ffa2f8b06
SSDEEP 24576:ku2EzC42irfhV2s4nYwvHcnGeha65+QSP4TPeBUX/gMgs/wSyKuPx:kuJzv2yVVoHcntha65XSPeMfZPx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Network.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Network.dll
Size 2.0MB
SHA256 ee860831eeaf34792d403b1d42fb5313fc0b3396c370f8b36924491f159c85f8
MD5 0f315a61e5d7a8693c55458f9576f292
SHA1 8a9e1caea0f3f629f3def7d05e047a9bf0173942
SHA512 de85ac62c0d596e5f147770d0b6ef2df9ffce2d51331e36110838816da49150c52ee33e2eda961d7749274ff20ce6ac10e10e421662a4c92e7190c2e771df397
SSDEEP 24576:cqwd/b2566e79LTM4SnRS7ckzdED+UFPGQ:cqwdz2566G9L4FAz+D+UFPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Widgets.dll
Size 4.5MB
SHA256 0f8264e423c16a3497ba5e41fcf42c8c15238ecf8eec2de80975e52e5682b681
MD5 190f4bbde9cf1bd67097633899302cca
SHA1 556835731eb165e27ca89fb03e2169a7d6467bea
SHA512 900d1d4b405ce8c5995702f72094085650f438e8604e984f9fab397badbc69cc8784dee8e917312bf62bded7baf830666210abd8943925b32e751ba3f5cd23eb
SSDEEP 98304:sVK51qyNnGVEGUXNr0x7MQSFXee4eTrfv3:rGVEGUln
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Widgets.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Widgets.dll
Size 1.5MB
SHA256 cc10b564387bc005692d7e178483b27b63953f73dc7f3eb87d4e32935ed4367b
MD5 5581bb033e2f1642adbc5293fbb162c0
SHA1 584c2b3743cda8211d4e337ea0594ac42b70a0e0
SHA512 ff22a99c3a4f3bf52da0e08047bf3ce16f2479166526a4f70b27c0b5b7eca85d123eeb5c7e2c26ede8237ed24976fe3f3bf4d7d5fce93cc39201144d2ce494c7
SSDEEP 24576:M8udV/atl7ZFNokJ8LC6uMgMqJFJioPHii4pIftoFLuo+o4YsH/qHVJjMiBVEGUw:M82VmNokJJF1Mq1q2ftoBD+jHHeBVEGj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt6Xml.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\Qt6Xml.dll
Size 187KB
SHA256 04ff3840b3a84ae2ed1b4a388a5e6ba5e7fe05f64bde8919d10739a7fcb8917e
MD5 63e76c8c687df6aec9f41e3d8a1d0746
SHA1 7577d4d681c012a3ded924e2f30aa6969ca5e815
SHA512 e4a65b254b0e7b2c1cd0f19d6c3b7df5b044ed7f90aa08e8163f93998624f6ffee13715796f55c5a780b77ac2c900fd2070dbf9b2799ba43f3b0d8fc7cc5b141
SSDEEP 3072:dpt7SgOHP2rvbTOpJDLuoNBrEfG2gmSSVzScZVTsctWJxb/mUGSE+G:pYerkNRszgmPzSSVZtMb/mi
MD5 SHA1 SHA512 SSDEEP

Submit Download

libb2-1.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libb2-1.dll
Size 42KB
SHA256 d6754584336b179a02722cfb80854f764024b6649e6f0cbf2d3878407e5678af
MD5 87ab9208b130b7d7b2dbf6e887aafc5f
SHA1 afc23cf59beea5dea0e7b4d7f96b936ab4594511
SHA512 fee411c30bc4df1777f42df27deb198114851672c916b197e8a1eb44f39fc88ba801703f24d06c51a72ec952d91ed992695f1c38b32689b54be8c578f23db8c6
SSDEEP 768:TCkFQpFtYAuZbKrbKlK6zy7GvC2mErBSnan50zkoaAcvVO:2pFtYA8lHy7Gvhlg7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

libbrotlicommon.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libbrotlicommon.dll
Size 145KB
SHA256 fc5bf42b62da64ac76ffcdf50f232c8c821c9c278e23f63c9477c75a74b2b7b7
MD5 00bc42b62d1a5adeb2f599a591403d9a
SHA1 42fb609f84e1fa97451a10aba914cda6db950b06
SHA512 2407e732a44b5293260a882b8118cd18d1e5d5339735d19efdef0c33ec5bed64aa4d099f1ab7eb590324e0c860c4a5bc7ba04eb04f5d9fadb1407c078d32d91c
SSDEEP 3072:Y04lzbWhNbNL8DXGvVh73pbi0tdpvGJaoZB7PxBlavxA:Y04AhdNorGvHdbi09GJOx
MD5 SHA1 SHA512 SSDEEP

Submit Download

libbrotlidec.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libbrotlidec.dll
Size 63KB
SHA256 ce832348f2e913ceba2d0b94d9a8fe655035e438067ad9a7527b1d7e556acc27
MD5 6b933641e6a997c2a100191783370ce9
SHA1 0ec5b215cdcb3c5ab1fcca8c1591474349cdab7f
SHA512 6308a7a34ff517e7b43958ad119206b44f92b75456617285b520e8706bede28d1b319c3b57253cca45d208988a6ef4e2720c3e343b0cf7ca876ecb0cfed2e3c2
SSDEEP 1536:QI0kv30D1vleo2465oymusFCfJq0rHoJXHLf:QI0n1vso2AAsFRXHD
MD5 SHA1 SHA512 SSDEEP

Submit Download

libbz2-1.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libbz2-1.dll
Size 96KB
SHA256 22289ed41efbe633f798047de836b31170336e5e40e7e7b586c915bdbda7fcd9
MD5 b843434a8eae82adea4f9eaa2fbffe47
SHA1 b34aaa305cfc1a4936a88592b5689b0c978ffaa4
SHA512 9f7c152c3b7ef52c0b3131d865960f8529bfe43776bfcf00c668fc41258e4ba4fcecb09888a99f77634534b42202d57e71806b808d9efe9ca6125712b8db7570
SSDEEP 1536:XbxAQ+Ny/Nl+cBvnbHGFQAa0NkQZm4BZkd38pR/yjr/wRFULiQW8TbOJ:LOQd+cBvnNA1FZk2U1TbA
MD5 SHA1 SHA512 SSDEEP

Submit Download

libc++.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libc++.dll
Size 1.4MB
SHA256 7c2515f1a68339b2f100a56aa69c2fbd1223a1e649caaf220e3b81c779a1b08b
MD5 0314b68d4684f7fa62c9273df902bced
SHA1 c8cd94d2a41c66c56b3dd465868c800bfd201a83
SHA512 de5219e3e2d415b1c02b64191b4de51ae6080059495f8109bf01a88365a27ac1691012a11ffddb81279fab792453f67a148def4aa52c012a8a9b6a7fecf4fb25
SSDEEP 24576:8hW+7fWNZKX7iYe+pshSMXl2hJR7l1SLubPX3wN+lQBwms6paQgR8h:eWStX7iYvUWmssf
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcmark.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libcmark.dll
Size 249KB
SHA256 503c476dbc9f57cacff1062e6bc48f70e3d9f00453180ba7bc4cbf4373810fa6
MD5 f5f97439ea8c9b6ee10b76b9f94e2fde
SHA1 4e1ba63e394087fadbb908274b6ae77c3b92b59f
SHA512 091e2997e29862aae35d9d9deb7db83356933cb3de89f80f5a239f9f3914d8f4218a1f2393055000707826baae9c4f4a3f43625a4eb3fd4f098f91ca34fe819b
SSDEEP 6144:X4P6AHOX/w2nAJm78FHSNsLmZY/KlEzuh3gtyLsZmfkt+AVb0s5SLl4:oP6AHQw38M
MD5 SHA1 SHA512 SSDEEP

Submit Download

libdouble-conversion.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libdouble-conversion.dll
Size 78KB
SHA256 52a913618d12f2e02d756d7c8af5199ed77d61c47cf3c94cd23209f64b001eb7
MD5 20d6fca191ec4998242748eb54df4905
SHA1 e2d5afc4a3778c73762ebb4af9c446689a355a92
SHA512 49d6bcfd5f2d9c304b81fae3a18d642302a5055f64a98b27e72e277b1f5cfb2ddb77d0080624ad5bf2ab62bdb215da7a44441dede5999b056954159c75184a1e
SSDEEP 1536:vBek0a0m7qSccFJnwYYQ3uxadkYqHpgr:Zek0af7DTnGaSHpgr
MD5 SHA1 SHA512 SSDEEP

Submit Download

libfreetype-6.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libfreetype-6.dll
Size 828KB
SHA256 7a3258d807643e786983c107c49a9bcbe9bc755bc0a32e0f548d3bf8c048e818
MD5 7e0efe15a52434441699b4e18a403012
SHA1 d4564f3ba2e8236003d13e2e5bce71248fc655c6
SHA512 b60c46832556fcceaebd81f72667c6548e4f0c1655bb2d9a8e424564751fe46a766339850c92a4145064c3439a020ff23734228abc7151e1dfdf1b76f5ca2916
SSDEEP 24576:Ex9EPoJMcBbPgDE7yf/mQNWkiOBlBCZXd87VZ9p4lu:2EfcBL8Ik7lY87VZ9alu
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglib-2.0-0.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libglib-2.0-0.dll
Size 1.5MB
SHA256 451f6de29a44a7a525d1c43e3439837e4afe5bcd0cfc1b8715bcc85ae2556d4e
MD5 e5cac1960181ceee198818ed98aab8e0
SHA1 9de2f0aef00de17855a7232a99e07e21661d0da8
SHA512 11ff53b6ce7bed01c0935b6d336262f646b35c9083cc88c721acddf838bccfc0b9f71e11514e97815c008a6c7bd93767ac3c79be1917c925c5bc67682a969c19
SSDEEP 24576:YFsvpxsO1uWNY7NMMIN1Rd8cm+mIvASaWtv59W45wUZA1ykjGkmwOFm:1vbskY7Od8cmfxmtvpZA1EkmwOw
MD5 SHA1 SHA512 SSDEEP

Submit Download

libglib-2.0-0.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libglib-2.0-0.dll
Size 1.3MB
SHA256 92a78b5fc44d32d0e0b47d0f7ed4f9193d792e2358d30f3716c010e4744c82a8
MD5 94b2d5d665a890eebcae127bebc9621c
SHA1 bded4b753f69d32e46612197f44b3dc4ae0b3c81
SHA512 2cf0aff828f9300469115c6e4921f77126e3b6174a90411e825fcc0defc916d85460f5caba557db8ded3d247e05c10efbbf776e2b868f55b4737d2899f9cde88
SSDEEP 24576:YFsvpxsO1uWNY7NMMIN1Rd8cm+mIvASaWtv59e:1vbskY7Od8cmfxmtv2
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgraphite2.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libgraphite2.dll
Size 149KB
SHA256 51ad68c31e706d4d9181cf3f15df259e5962644f664a3723d6ca48f0ef4fb8c4
MD5 c8dfe47f78c491446d7b1c39449d82be
SHA1 218fab832b78f14072be0d2f9d7d9775bba24323
SHA512 39ea8978571db1c5b1c89134e53d799932092f5102e0390aaa28cebde3ce1049e92287db49ed9cc2b57e4662a464e17bf945b221a496ea90bad52b882e86d903
SSDEEP 3072:dZgCQBHA1F/+q/xNjjSLUOCsv7S314txH6ANc12:dZYBAhxNx4tMAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

libharfbuzz-0.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libharfbuzz-0.dll
Size 1.2MB
SHA256 cd99ef0a232ec917816e8be1792213fb00a196b9428e9cb0a6cd022fc5f04ffd
MD5 4234bf41775eda6bbe8fe5991184b8e1
SHA1 cf4e906b6eda0e8bdb50cd6f53e9b13f058d5716
SHA512 8331d5e039fb8c766f64670096c07c866826786cbe4802418ed2ab6eb38a2bd1e57bdb85e0d06a431883b87ba8943366013d26a8ae5d790e6fa93ae11743566c
SSDEEP 24576:uPQUgqlRsT3DVs/MIzByQc+bDXMIqTOWAaY5sIz:uhgqfMIgQ5cLKxaY5Vz
MD5 SHA1 SHA512 SSDEEP

Submit Download

libiconv-2.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libiconv-2.dll
Size 906KB
SHA256 e3ce65d4871bae8fdd15972c331b9cbee4ee395476f12ac12aa560cab2596710
MD5 3574af39c490411c6556c3ec5dc2a930
SHA1 0b87d4f876bd164ea657aad8bd058b52b9b25219
SHA512 eebe2ec0e28d5abd645abe339050140b26cdfe84b45a1bda7a56a2e7466c88b7ddb332ed7bbe707cce724f8783a4c720943d042b091f2af2053562328a1e1a60
SSDEEP 24576:hCf2h8FfrNffGavkg3NyElQKuqsbbTujvK1:hCQQZXGaXDQKuqVjC1
MD5 SHA1 SHA512 SSDEEP

Submit Download

libiconv-2.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libiconv-2.dll
Size 64KB
SHA256 7dc17dce9a8e44d42fde3579e51fd3632e9657ec240d5b61924f334c22455925
MD5 6fd324e99fab74ddf6c78369105e5f4f
SHA1 78f77f93def4f8830e4c28f2e6ae5d079e4ff65e
SHA512 250425c2dffbe5476fd2e0f0bb91632c73c7b853f624e15831064d1a33a88db8733f214e4e942002e9b53add63e7ef5f20f1201abb51bca5efbad51ace4004a6
SSDEEP 1536:L9xSHQU4FYhRled/RxGR/DD7ROUpy6GdZjrvKiVhMfT2STmkrLXcXeMB/:BYHXRuZ31jCTsELMXe8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicudt74.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libicudt74.dll
Size 64KB
SHA256 bfbe143b4ff6fa08859d9f4c375de5b3cf49eee747879a8e7203ef526d308d7c
MD5 77bb4abad4e14be55a5fc4186af6a960
SHA1 7f5820337e6bf289c0c32ca9dd598dde2d8bde79
SHA512 eb50de33ddd9fcadac345b151b0ee39161741d8fdefc404a693f5a5666ca6c225b44b78a819f4658815ed93e146bd045b66643530d2c477a6b34b6705f83247e
SSDEEP 768:qUyoB+1+nElp3JaAxgqDL+dLsNZbhN7S4esSyly++AEWVGVgyVIqwj/EQ:qv+MxJa0+dLYtSISylyPWpywj/EQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicudt74.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libicudt74.dll
Size 1.2MB
SHA256 c5398b79c2606b08d55685cd2eebb08d35ac3e02738d71eb8949d058e8f74bc0
MD5 4f5e7f691ea441ca8bd00a0a60438796
SHA1 da6d305b43a177f62baa9ceba4d13a71e608e178
SHA512 3b2032731a2e16f6648e2e52d3a6c0dcc9af2ad6c368a8e876bd2f8b3e8ed152d0ae468a3d0ebccfbbfbb72eaff806ca415189b23bbb10344cd55f2bd0fda8de
SSDEEP 24576:w+ArHB6c0mFhw3zVtjTiEoTAT5FIKVbXWDk:w+uBn0tJJkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicuin74.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libicuin74.dll
Size 1.3MB
SHA256 0848ca2e049e4dd2a7a0fe01c5ddb9e7c1210bc1291cf9396d403ff12c99b5b0
MD5 ad7f584de4a936d2aa0c320031fda8d1
SHA1 ed5d8e4c0c4762866686920261d56b3c01cedeb2
SHA512 7b1386be23f646397a1b545b203430f427483e7952ef108e4fc771ed0189672be551d481c0e82bc0b63db857c06214af1e625aabd38603e3b8127bbd538fd058
SSDEEP 24576:rXEVhXqJd9WyQu3uiGhKB3PEJeEV1WzGdwhXy8Usszyi1dVDHQVWKnex464f:r+9qJnWyQ8G8Bs7WzGdWXy8U/zycVDH6
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicuin74.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libicuin74.dll
Size 1.3MB
SHA256 303d6ba2b6f614118d75fde6d76fbf8fd64298125c146dd023bd7e03f8c94224
MD5 1f97e0ce5b718ef60002bb25aaa8b503
SHA1 e8a00b1f9233e1b5a46a57a9b7660d72710ef2b5
SHA512 b705e8576f389d1cba10a37529ced8c41b0e4d437fb1dacb8aab6c9656f0d2cc1cd98ea885bf5a7ad79ba270f4c7126117b658cbb3ece98778f8cf05957cbf8f
SSDEEP 24576:rXEVhXqJd9WyQu3uiGhKB3PEJeEV1WzGdwhXy8Usszyi1dVDHQVWKnex464l:r+9qJnWyQ8G8Bs7WzGdWXy8U/zycVDHK
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicuuc74.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libicuuc74.dll
Size 1.3MB
SHA256 b34cbdf9cf69b171c0ac354ffcd619de416a5c19b471b4dc170b5834ab974125
MD5 86a99f5649c44e13dd794da3d8d31282
SHA1 a008ffeff79ad11ea4d470bfcb73cf431ea3ee20
SHA512 1cb8803bd1fcec84af05a410b8466d79132dea9d93505862d38f91d4dfe22c98f0a0071d16338fbe2df354819166f74a0bcc18bde060878679beb78a27e411b8
SSDEEP 24576:Dg7qsy6STjE7+CCksT4rpEI1H/UA6z7US2hYTdfiBL5kkkkkkkl:DgWsy6qECCty4ryIh/UA6z7US2hY8
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicuuc74.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libicuuc74.dll
Size 1.0MB
SHA256 3f8399b196895110afde2aa1e0a6b5f557f908294938aab134da83ccb1f27d6c
MD5 947a2cb14aa296c9256771012617526a
SHA1 67e8dc936693f8f7c8045d14ed5f52e65390f661
SHA512 2338dc788781f8333fbd26aeb2a3fc325d882e8a8661de34e35399c8467ed3a677544f703968898728afb052041379b103413d6a9c8adc1a4a17fee5ca41f3e5
SSDEEP 24576:Dg7qsy6STjE7+CCksT4rpEI1H/UA6z7US2hYTdfiG:DgWsy6qECCty4ryIh/UA6z7US2hYf
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicuuc74.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libicuuc74.dll
Size 1.1MB
SHA256 43fb41684e968fb4b5ff38e0b38edec42da7e4649fcee609bf2d40d74970d4bf
MD5 1ca5b7297e5afdcea2703b89f42c9c4a
SHA1 16f6dd4ea37e699d61cc99964c729b1fcc570139
SHA512 36f82a843747496c8c7d5f4a126a9626b5aa31b8fc6c7f8d89a720bbef7f2cadc2205bfbed3587c78d6c901eb9d6233734f8f711bd8dc3700de0615a859bbca4
SSDEEP 24576:Dg7qsy6STjE7+CCksT4rpEI1H/UA6z7US2hYTdfiBn:DgWsy6qECCty4ryIh/UA6z7US2hYq
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicuuc74.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libicuuc74.dll
Size 1.9MB
SHA256 a6954486fd81ad3464845af7f0fe7f06a5424b5ab84f033f9627ac7f1e82395c
MD5 3887400042525e2c976f6ccf9ed77ba7
SHA1 4edb5798f73c874591d26c196f09c2139f90fc62
SHA512 ce94fc4a65ea2a0277d45e60b0e87d0b86730ff26ed9977b2b256dea6790965fe8c432e4a444c27c72341c965d6faea685847cdc9ef90150b72e1ae10ee5d3dc
SSDEEP 49152:DgWsy6qECCty4ryIh/UA6z7US2hY87nLwmoqvn4BVN:0DUEy42hJ7cL9SBVN
MD5 SHA1 SHA512 SSDEEP

Submit Download

libintl-8.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libintl-8.dll
Size 196KB
SHA256 4dc000c25b05ff454bf4387ece7002fd77049a2d2daf98d228ba657f3dccd4fb
MD5 e3de79fc630d7fabb9118a4f7ea53971
SHA1 dcd7b2f6d68f897501b6464588537f452ec29726
SHA512 47a7cca88728d89b097603ae244b5abb27c4fa2c20291180f1829e31fa4de15e89afdeaa058dcaa3750fc9db481e1778537632eabdfe63b55f2707b627cdf280
SSDEEP 6144:U5LtkVxCjgH0mwjfC56ldJHnv47ntFNihr4O:U5JkVx/UmSfA6Vw7Dmr4O
MD5 SHA1 SHA512 SSDEEP

Submit Download

libmd4c.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libmd4c.dll
Size 78KB
SHA256 bdbafd132c7b5a162b6d83e5c49a3e0b3d86a609ae01be8f99d2f7573f7cca06
MD5 09eee10544ef56a8fa86517fa80f2bf5
SHA1 68977088641b2356fccbcaefd4cf0cd37aeb68ca
SHA512 5684315cf49061d517341b8d1f2ffbc579f0ca0907f42c234b68e9fcf928d65b33f75f16d1f2908a07285598e3a4c92d69f754d7cfe58c6f25f8c94529b5a4c1
SSDEEP 1536:Ji4KNXms1febEpu07DpNlu25LAapis1k4GGmlOy90L:JiFNlpebEpu03pNzptmd0y9
MD5 SHA1 SHA512 SSDEEP

Submit Download

libpcre2-16-0.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libpcre2-16-0.dll
Size 353KB
SHA256 285824fa911fafbdb10949c5785b8902b4605a8333c4d7bce3bc9ab63016de6d
MD5 e5609c3469858b9f5ce8bb294275cd22
SHA1 47229f6eb790ad7d1b56f1e06c913850a8591e81
SHA512 eca1cc9ab9a355d778b952e3a22098b56932f39238268b09c747508f923cfb52453d6618af77baba96a0e4b2e8ce9f692af2f59720a273da78487b7c43d9bd9c
SSDEEP 6144:QPloY5bgSD1DnkdlPdqbPWsq9TAtor597x:QPloY5bgE1Dnkd94iscgorbx
MD5 SHA1 SHA512 SSDEEP

Submit Download

libpcre2-8-0.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libpcre2-8-0.dll
Size 392KB
SHA256 57dadbe91cd2a7aa36e4bf30794dbe9bedd4183cc9277a3fc2b8ba50a78a273c
MD5 15d5c11c10693fbf46c929f71b1de96d
SHA1 273a39b7bb3651bb51caf05504213303b341d942
SHA512 70da5db227271e3dcd5876cb7eba47316a304791c40bb824bc1cba3ab2625b9174842a3504555454a3244fe91e3cf48dc87f47aa1a6fa2c5a5bfd5b28031db19
SSDEEP 3072:KkxK2ggMzRggrggggggggggRcHXOU0Q4v93KB8jjAnbSzQ6AFyaW+7gJK0pfzhR5:B49iXOJl4KkneQ6A4/405fkxw1E+ZJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libpng16-16.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libpng16-16.dll
Size 269KB
SHA256 0b51dd5b254595dbfa003d5ce27363412ee098612837e569edebabe2149b636a
MD5 980ce62995e2b0fc6d809a64bfc02896
SHA1 601eca760fbea62b992f1bbc9ef83e6b33235392
SHA512 d5b2e88a165ca41b45fc03f35eed02995fd0028067fe92fefff0e5fb57895f69608934a754face68b2555b2bcbe747166f172f720d5e32ff07d961a4f3860c67
SSDEEP 6144:74giQZogHmvW1xMfdUk8M4mnRL+CHxEDjlNvD:7rtqStmnRLJREvvD
MD5 SHA1 SHA512 SSDEEP

Submit Download

libquazip1-qt6.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libquazip1-qt6.dll
Size 250KB
SHA256 3f06ff804caff1aa10da61ff9b3c8e060b1a9ad54cf336e582bf7422f7ea639e
MD5 92fd1c7887462c3e2d8c4b75329c14d5
SHA1 3305b83190612b47a90f34e20687fc2159d8f7e7
SHA512 61a25ff7ef8f7651c4798659a17f9fdd2111752e9cc5da13488d54da8e90fd3e1259dac69342a19cf2f2b882df2442d290dcd72bee2ec7fc6c610c3fe0f99fcc
SSDEEP 3072:taWaLhgTzF+fltFDaEIbUOaZu4mi3Ilv3NP69iP3h8Xl0+rsE8Dh63+PdtcXOX/g:zzF+fltFD9Ix6+vd3PR810hPtc+XwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

libzstd.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\libzstd.dll
Size 999KB
SHA256 f9b8f326310503b8a79f8d16a80367728af0240af7cb3ea820f81144d2010fc3
MD5 4cc2b0f5e67f781406696b8032f30b72
SHA1 cf957e5f56c148d8fcf005989da1443c55ef190e
SHA512 b31e6377134dfcbc3b03c6be30d20bb721ec9dc395f68e497292469eff39dbd543e30593d0e18ba4548cb1c85f0e9b0a3c2ea8a4fb2ec8134a3ff93005daad79
SSDEEP 24576:gLbr7Lbrc5PJujQXfqSXqCUbCUeRym4BVWt7EX+1ciq7ir:gLbr7Lbrc5PJOQCSXqCUbCUSym4D+1c6
MD5 SHA1 SHA512 SSDEEP

Submit Download

pollymc.exe

Path C:\Users\Admin\Desktop\New folder\PollyMC\pollymc.exe
Size 2.1MB
SHA256 a0deee27e08aab87113c15788ffa0068f693423210e4c36f24f222a80af5b8c7
MD5 6d1b19dbd04fe40ee73bcb6235647d18
SHA1 0d74369ed02357880ccb77941ffb5309c7f01cfd
SHA512 4587a5f22ca1e979fd2a69dc33124ace7627d493efe9a216d44d96bf16a0642418aa68537eeaced726addf4c58a2a80fb4c4ee8977113e6786c6f0dbff73d700
SSDEEP 49152:8iNCFt1klItxcKvpE3U+iiKuBWpxYwv+HAO5d:3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

pollymc.exe

Path C:\Users\Admin\Desktop\New folder\PollyMC\pollymc.exe
Size 851KB
SHA256 2c7d235e55e84be4069dae83fe9157290da0bd6893f32a1fc07c947499bf1eff
MD5 d30127e378b99deab11c47dd24bdfb16
SHA1 530cc7307bc8136039f8e5eca34ab424717cbed5
SHA512 5ccbbbd4056a43b92cf689433aa38f8980e527e0009e43c411dc55ff5dbf41ce77b7417666570c66020fb4189fa70342754777431db8f16dcaa1091aebb66cf2
SSDEEP 12288:8iNCFdf1dC4VQt+7WItxxDDe4ZycZg3wpEkzfWUkYwHmeoREVh:8iNCFt1kaWItxci/ZvpEkzeUkYQGRih
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib1.dll

Path C:\Users\Admin\Desktop\New folder\PollyMC\zlib1.dll
Size 108KB
SHA256 7ef90c6875d176bae42aedc6720bd27d8515431a19b37c6a071f3b19f82a9eb8
MD5 17d86210bfddc727ba2751fd02c533e1
SHA1 c1c53c48c78852003045114c030747dcff017aa9
SHA512 c7f1a80a2285de93d63c9b7f069da1966ed16415ca01f02faeb9bd48b3d00f6e6d190aaf5f24d11f8ad78b6b2a8ff9c96ef7bfb7e80d6954cdfb73dca24c9152
SSDEEP 1536:FrydO0SYKz3fBslsm2zVeFb5ERhlb2ZFxVhOYERn6dhyIOUIO2d6iaeL6ML90:r0g2lsTUFb5ELTh2Q62d6iaeL7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1084-249-0x00007FFCC2EA0000-0x00007FFCC2ED7000-memory.dmp

Download

memory/1084-216-0x00007FFCB1120000-0x00007FFCB128A000-memory.dmp

Download

memory/1084-232-0x00007FFCAD2E0000-0x00007FFCAD334000-memory.dmp

Download

memory/1084-212-0x00007FFCAF770000-0x00007FFCAF936000-memory.dmp

Download

memory/1084-213-0x00007FFCAFB30000-0x00007FFCAFDFF000-memory.dmp

Download

memory/1084-220-0x00007FFCBD680000-0x00007FFCBD6AC000-memory.dmp

Download

memory/1084-231-0x00007FFCAD360000-0x00007FFCAD375000-memory.dmp

Download

memory/1084-215-0x00007FFCAFE00000-0x00007FFCB03B8000-memory.dmp

Download

memory/1084-217-0x00007FFCC2E30000-0x00007FFCC2E8C000-memory.dmp

Download

memory/1084-219-0x00007FFCC2190000-0x00007FFCC21BB000-memory.dmp

Download

memory/1084-194-0x00007FF6CF620000-0x00007FF6D0304000-memory.dmp

Download

memory/1084-203-0x00007FFCAFE00000-0x00007FFCB03B8000-memory.dmp

Download

memory/1084-218-0x00007FFCC2F50000-0x00007FFCC2F8A000-memory.dmp

Download

memory/1084-214-0x00007FFCB03C0000-0x00007FFCB0AFD000-memory.dmp

Download

memory/1760-288-0x00000280E0B20000-0x00000280E1B20000-memory.dmp

Download

memory/1760-318-0x00000280E0B20000-0x00000280E1B20000-memory.dmp

Download

memory/2192-313-0x00000285D8EC0000-0x00000285D9130000-memory.dmp

Download

memory/2192-308-0x00000285D7880000-0x00000285D7881000-memory.dmp

Download

memory/4196-311-0x00000131987D0000-0x0000013198A40000-memory.dmp

Download

memory/4196-310-0x00000131987B0000-0x00000131987B1000-memory.dmp

Download

memory/4844-312-0x0000023CA14C0000-0x0000023CA1730000-memory.dmp

Download