Overview

overview

10

Static

static

10

Client.exe

windows7-x64

10

Client.exe

windows10-2004-x64

10

Resubmissions

05/09/2024, 13:44

240905-q16deasbkr10

02/09/2024, 17:59

240902-wk51lavbpn10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 17:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Client.exe
  • Size 158KB
  • Sample240902-wk51lavbpn
  • SHA256 dee58e8a247eab9726675a03ddc8485c66a204d7b9f2211d8fea89729d45e7a5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
arrowratclientcredential_accessdiscoveryexecutionpersistenceratstealer

Malware Config

Extracted

Family

  • arrowrat

Botnet

  • Client

C2

  • 6.tcp.eu.ngrok.io:13114

Mutex

  • rLGiSBuYa

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa
      2⤵
        PID:1472
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 6.tcp.eu.ngrok.io 13114 rLGiSBuYa
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3808
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-sandbox --allow-no-sandbox-job --disable-accelerated-layers --disable-accelerated-plugins --disable-audio --disable-gpu --disable-d3d11 --disable-accelerated-2d-canvas --disable-deadline-scheduling --disable-ui-deadline-scheduling --aura-no-shadows --mute-audio
          3⤵
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:828
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\Pandora /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\Pandora --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb8cbdcc40,0x7ffb8cbdcc4c,0x7ffb8cbdcc58
            4⤵
              PID:4300
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2012,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
              4⤵
                PID:4860
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --field-trial-handle=1836,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:3
                4⤵
                  PID:4024
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --field-trial-handle=2036,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:8
                  4⤵
                    PID:2632
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2828,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:1
                    4⤵
                      PID:1768
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2852,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:1
                      4⤵
                        PID:1652
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --extension-process --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3376,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:2
                        4⤵
                          PID:4888
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --extension-process --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3348,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:2
                          4⤵
                            PID:4532
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4092,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
                            4⤵
                              PID:672
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --field-trial-handle=3116,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:8
                              4⤵
                                PID:1684
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --field-trial-handle=4332,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
                                4⤵
                                  PID:3008
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4336,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
                                  4⤵
                                    PID:4312
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4440,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
                                    4⤵
                                      PID:4736
                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                      4⤵
                                      • Drops file in Program Files directory
                                      • Suspicious use of WriteProcessMemory
                                      PID:5192
                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x26c,0x270,0x274,0x268,0x244,0x7ff7e1f94698,0x7ff7e1f946a4,0x7ff7e1f946b0
                                        5⤵
                                        • Drops file in Program Files directory
                                        PID:5252
                                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
                                        5⤵
                                        • Drops file in Program Files directory
                                        • Modifies registry class
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of WriteProcessMemory
                                        PID:5292
                                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
                                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7e1f94698,0x7ff7e1f946a4,0x7ff7e1f946b0
                                          6⤵
                                          • Drops file in Program Files directory
                                          PID:5316
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4488,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
                                      4⤵
                                        PID:5588
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --field-trial-handle=4476,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
                                        4⤵
                                          PID:5596
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4516,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
                                          4⤵
                                            PID:5604
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4412,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
                                            4⤵
                                              PID:5860
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --field-trial-handle=4428,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:8
                                              4⤵
                                                PID:5876
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4668,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
                                                4⤵
                                                  PID:4476
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --field-trial-handle=4460,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
                                                  4⤵
                                                    PID:1760
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4456,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
                                                    4⤵
                                                      PID:5220
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --no-appcompat-clear --field-trial-handle=4732,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
                                                      4⤵
                                                        PID:5880
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\Pandora" --extension-process --no-appcompat-clear --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4500,i,6386611956974961025,17420569228484047524,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:2
                                                        4⤵
                                                          PID:5112
                                                    • C:\Windows\System32\ComputerDefaults.exe
                                                      "C:\Windows\System32\ComputerDefaults.exe"
                                                      2⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1140
                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
                                                        "PowerShell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Pan\dora'
                                                        3⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3764
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2180
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                    • Modifies Internet Explorer settings
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4876
                                                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                    1⤵
                                                      PID:5112
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:5204

                                                      Network

                                                            MITRE ATT&CK Enterprise v15

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            settings.dat
                                                            • Path C:\Program Files\Crashpad\settings.dat
                                                            • Size 40B
                                                            • SHA256 a523945e3f1cbc365dd8b53f51c9824167478d8133790ca2d4bff4cd06cea172
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            20240902180109.pma
                                                            • Path C:\Program Files\Google\Chrome\Application\SetupMetrics\20240902180109.pma
                                                            • Size 520B
                                                            • SHA256 db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            data_1
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Cache\Cache_Data\data_1
                                                            • Size 264KB
                                                            • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 96B
                                                            • SHA256 138b8863d4c98aa4ae0545a6567c7e41853e678ef50fb88cf2c9f2edaf8752bc
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Code Cache\js\index-dir\the-real-index
                                                            • Size 48B
                                                            • SHA256 0b2f1e2c381e7854d2fa9d936800866f6339700559879f755dea5143b95393c4
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\_locales\en_CA\messages.json
                                                            • Size 851B
                                                            • SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            dasherSettingSchema.json
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\dasherSettingSchema.json
                                                            • Size 854B
                                                            • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            CURRENT
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Local Storage\leveldb\CURRENT
                                                            • Size 16B
                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            MANIFEST-000001
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Local Storage\leveldb\MANIFEST-000001
                                                            • Size 41B
                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Network Persistent State
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent State
                                                            • Size 1KB
                                                            • SHA256 062500beed24d92dbe3a81e7f42577b96679e6f6e5a3ed16176d8d13b8d081d3
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Network Persistent State~RFe59df5a.TMP
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\Network Persistent State~RFe59df5a.TMP
                                                            • Size 59B
                                                            • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            SCT Auditing Pending Reports
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Network\SCT Auditing Pending Reports
                                                            • Size 2B
                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Preferences
                                                            • Size 8KB
                                                            • SHA256 68d30c041cfa4c34d2890e17bc0947da2b3bd74bd8d4853efd976649d69a6bda
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Preferences
                                                            • Size 8KB
                                                            • SHA256 15c8e5c5d7185d6ea42599a5b5a3116f828a56d4f87f83c3fe2fa8425cd50fd6
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Preferences
                                                            • Size 8KB
                                                            • SHA256 e4462074b474f92924c360289af5e2e4399d40eda57ba9a5eb2ec75ce0008606
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Preferences
                                                            • Size 8KB
                                                            • SHA256 471fcb05b9600a5c5ed28bcccbb286b3794a75bb61c7c86df744ad93aaf6eb0c
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Preferences
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Preferences
                                                            • Size 8KB
                                                            • SHA256 8fd0267c152f1fe28c3de451b28cbb8e006c7d206988c4bc0131b4736628296e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Preferences~RFe58ef3d.TMP
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Preferences~RFe58ef3d.TMP
                                                            • Size 1KB
                                                            • SHA256 803c5f0591e1990ec46ecd173e71c3799fbf5cd518d579c68cd693436563c53b
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            the-real-index
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                            • Size 72B
                                                            • SHA256 08dc714c704dbfc2499bb1cdfc733e7e5a20196e2b5afe52d6930c0c3cd42463
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            the-real-index~RFe59306d.TMP
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59306d.TMP
                                                            • Size 48B
                                                            • SHA256 33f1fd437cf85ef7a4d98528192165ffccb712b42202091b4392d6715d0a08cb
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            32.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
                                                            • Size 1KB
                                                            • SHA256 91289705a496311822aa52d067f2a029025293f1c22779f3a8bc483e211ce1d8
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            48.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
                                                            • Size 2KB
                                                            • SHA256 102aeb88e02ce1cd5c91ce4ab3c5880be33b6a440ee7f24c9e38741e79b46273
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            64.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
                                                            • Size 3KB
                                                            • SHA256 dc78a4be5b92c40c32dbbd4bcc3c65057105db062c088fadcf835a5e161095a1
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            32.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png
                                                            • Size 1KB
                                                            • SHA256 be3a2fe70a27da2e9836e8b96a0dcfdd980702f69124f984f82de2b8699fe977
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            48.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png
                                                            • Size 2KB
                                                            • SHA256 d67823095d8a91a0d4638ba75216c2f4b467f4fca5a56c4e45e88091b17dfdc5
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            64.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png
                                                            • Size 3KB
                                                            • SHA256 e036bcb9f333d3d7e12492247e02fc6d599e12c42cc008fcbbac37def93ca0da
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            32.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
                                                            • Size 1024B
                                                            • SHA256 3d7283090cf1a87baae4032266e4d144f7ec2ea465e7b2bf02728aa394c678f0
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            48.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
                                                            • Size 1KB
                                                            • SHA256 6e21221baad8ccd2b71542f9d3194dc5868c0f424fea640cd4915fbdb32f4804
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            64.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
                                                            • Size 1KB
                                                            • SHA256 2a8f1a1cfac4fbe96a6cb69e9e621201875cc45b2e60bc75b08ea193c759e346
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            32.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
                                                            • Size 1KB
                                                            • SHA256 36670568a87c7b3cd1a4448ffe5bde9b6fd3d65b58e6dca38cc4ea2e9e8c11b3
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            48.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
                                                            • Size 2KB
                                                            • SHA256 fa58e3209e408e4f0d60a7ed330d6f62884ccf9b593e37cde03e7916c116dd1f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            64.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
                                                            • Size 2KB
                                                            • SHA256 80c1e2f4d89d5266f82dc0295f232eda894812820c5c625a036adf980536e5a8
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            128.png
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Default\Web Applications\Temp\scoped_dir828_198689631\Icons\128.png
                                                            • Size 5KB
                                                            • SHA256 8a9434f0ede8c6edf65f8d5750852be574847a62a4534e1b6b372078463b6d04
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_0
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\GraphiteDawnCache\data_0
                                                            • Size 8KB
                                                            • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_2
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\GraphiteDawnCache\data_2
                                                            • Size 8KB
                                                            • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            data_3
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\GraphiteDawnCache\data_3
                                                            • Size 8KB
                                                            • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Local State
                                                            • Size 107KB
                                                            • SHA256 4f3c2756df250477a5c9df1e27463726e753a3d61ecc1116f797d1fbd98d2ba6
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Local State
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Local State
                                                            • Size 107KB
                                                            • SHA256 6780d9bce8eec6b46d798518f0833bcaf54331844f0d42b6fe22f55f550a4016
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Local State~RFe58ef2d.TMP
                                                            • Path C:\Users\Admin\AppData\Local\Google\Chrome\Pandora\Local State~RFe58ef2d.TMP
                                                            • Size 931B
                                                            • SHA256 92e27feb6e2286c41865c76c3a686be700a82e9606254fe1da3322bfd816208f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            0.0.filtertrie.intermediate.txt
                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bf02ed0d-1dcd-4cb7-a8ab-87203a310a87}\0.0.filtertrie.intermediate.txt
                                                            • Size 28KB
                                                            • SHA256 373bb433c2908af2e3de58ede2087642814564560d007e61748cdb48d4e9da3f
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            0.1.filtertrie.intermediate.txt
                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bf02ed0d-1dcd-4cb7-a8ab-87203a310a87}\0.1.filtertrie.intermediate.txt
                                                            • Size 5B
                                                            • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            0.2.filtertrie.intermediate.txt
                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bf02ed0d-1dcd-4cb7-a8ab-87203a310a87}\0.2.filtertrie.intermediate.txt
                                                            • Size 5B
                                                            • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Apps.ft
                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bf02ed0d-1dcd-4cb7-a8ab-87203a310a87}\Apps.ft
                                                            • Size 38KB
                                                            • SHA256 b1557167a6df424f8b28aabd31d1b7e8a469dd50d2ae4cbbd43afd8f9c62cf92
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            Apps.index
                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{bf02ed0d-1dcd-4cb7-a8ab-87203a310a87}\Apps.index
                                                            • Size 1.0MB
                                                            • SHA256 43da4fa5f62affe399ceaac2d489b7cde610963a48e72d445bebe6f2c63a3600
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            AppCache133697736029197031.txt
                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133697736029197031.txt
                                                            • Size 76KB
                                                            • SHA256 38ce129420f314bb136b6748cf56ba1443a837d7c3a53794e6fbc24a379a5c90
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            __PSScriptPolicyTest_eizqm5o4.1pa.ps1
                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eizqm5o4.1pa.ps1
                                                            • Size 60B
                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            cb38340b-5d00-40fd-bc94-6a1401f3309d.tmp
                                                            • Path C:\Users\Admin\AppData\Local\Temp\cb38340b-5d00-40fd-bc94-6a1401f3309d.tmp
                                                            • Size 132KB
                                                            • SHA256 f421d74829f2923fd9e5a06153e4e42db011824c33475e564b17091598996e6f
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            chrome_installer.log
                                                            • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
                                                            • Size 8KB
                                                            • SHA256 64e4b8071f6d4f9db74661a791b7dda290b9c3e4f037395a10f624b62df4689f
                                                            • MD5 SHA1 SHA512 SSDEEP
                                                            Submit Download

                                                            messages.json
                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir828_50070895\CRX_INSTALL\_locales\en_CA\messages.json
                                                            • Size 711B
                                                            • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            Google Chrome (2).lnk
                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
                                                            • Size 2KB
                                                            • SHA256 9b2722920113bde2898a39d91bdd6038bbca518db0b254da506496c003454246
                                                            • MD5 SHA1 SHA512
                                                            Submit Download

                                                            memory/832-30-0x0000000002E80000-0x0000000002E81000-memory.dmp
                                                            Download

                                                            memory/2792-15-0x00007FFB88240000-0x00007FFB88D01000-memory.dmp
                                                            Download

                                                            memory/2792-1-0x00000247F0E90000-0x00000247F0EBE000-memory.dmp
                                                            Download

                                                            memory/2792-199-0x00007FFB88240000-0x00007FFB88D01000-memory.dmp
                                                            Download

                                                            memory/2792-0-0x00007FFB88243000-0x00007FFB88245000-memory.dmp
                                                            Download

                                                            memory/2792-181-0x00007FFB88243000-0x00007FFB88245000-memory.dmp
                                                            Download

                                                            memory/3764-25-0x000001D89C510000-0x000001D89C532000-memory.dmp
                                                            Download

                                                            memory/3808-224-0x0000000005D70000-0x0000000005D7A000-memory.dmp
                                                            Download

                                                            memory/3808-7-0x0000000005C50000-0x0000000005CB6000-memory.dmp
                                                            Download

                                                            memory/3808-6-0x0000000005DD0000-0x0000000006374000-memory.dmp
                                                            Download

                                                            memory/3808-5-0x0000000005550000-0x00000000055EC000-memory.dmp
                                                            Download

                                                            memory/3808-4-0x00000000054B0000-0x0000000005542000-memory.dmp
                                                            Download

                                                            memory/3808-2-0x0000000000400000-0x0000000000418000-memory.dmp
                                                            Download

                                                            memory/3808-10-0x0000000006510000-0x0000000006560000-memory.dmp
                                                            Download

                                                            memory/4876-37-0x000002A1032E0000-0x000002A103300000-memory.dmp
                                                            Download

                                                            memory/4876-66-0x000002A1038C0000-0x000002A1038E0000-memory.dmp
                                                            Download

                                                            memory/4876-50-0x000002A1032A0000-0x000002A1032C0000-memory.dmp
                                                            Download