978dfe8f0fbb57398366e2302055b58fa641258f53db6909fca2b5a1e87ff3c5

Resubmissions

15-10-2024 12:09

241015-pbyrlatbna 8

15-10-2024 12:06

241015-n98tsatapf 3

15-10-2024 11:58

241015-n5mqrasgnb 10

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TLauncher.exe
Size

8.9MB
MD5

505731086d2f448e68c025a7003efe00
SHA1

e8358cf87df55712a7b6998d1816e94b57f3b7c1
SHA256

978dfe8f0fbb57398366e2302055b58fa641258f53db6909fca2b5a1e87ff3c5
SHA512

856ad2f0caa72c15b20831c7e1d8917329907381e1e95ce470ff3592755804cc17cd507c105d49fdecbc418a2c3f2b01e1be2ce15dc981aeb7f39ce2889cb4d4
SSDEEP

196608:vRAQAHQHWFm5kAiFWnuf6J/+Ift24xJN+vwvasDU6sU0s:LUn6nDJ/+v4xJprUB4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TLauncher.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133734677351328129"	chrome.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
4304	chrome.exe
4304	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe
4304	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	taskmgr.exe
Token: SeSystemProfilePrivilege	2760	taskmgr.exe
Token: SeCreateGlobalPrivilege	2760	taskmgr.exe
Token: 33	2760	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2760	taskmgr.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe
Token: SeCreatePagefilePrivilege	4304	chrome.exe
Token: SeShutdownPrivilege	4304	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe
2760	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4960	javaw.exe
4960	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4960	4856	TLauncher.exe	84
PID 4856 wrote to memory of 4960	4856	TLauncher.exe	84
PID 4304 wrote to memory of 1932	4304	chrome.exe	123
PID 4304 wrote to memory of 1932	4304	chrome.exe	123
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 3336	4304	chrome.exe	124
PID 4304 wrote to memory of 4832	4304	chrome.exe	125
PID 4304 wrote to memory of 4832	4304	chrome.exe	125
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126
PID 4304 wrote to memory of 4364	4304	chrome.exe	126

C:\Users\Admin\AppData\Local\Temp\TLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\TLauncher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\TLauncher.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4960

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffc9e46cc40,0x7ffc9e46cc4c,0x7ffc9e46cc58
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1756,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2188,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3196,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4080,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4748,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4752 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4768,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5108,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4836,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4876,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4048,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3516,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5200,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5412,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5420,i,15796877134658432206,1521153677686259904,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:2064

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
9dceccecbcc111f09593c01c2d4d796e

SHA1
d59e22efe52215a104a1d362c43f82d38a074239

SHA256
1678deb71d85749afbac226e1c2487c26bf6c7f506c169f8c9e888d2e0411060

SHA512
250ff729c1ffbee164d57b1818ee65579c515d091c340a79611e50740502488a9678913268b677558b80354e2ad80473b530e2ddc834ccfe2d15904c3d394982

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f0b700aa2d82986f6fd92602bcab5706

SHA1
45814eec12b1929b9ef3db2165e1ceabeb0391aa

SHA256
ed7a4f3b05e2084889041036e9511f2a22c3472da1412da0948f667db2468cbb

SHA512
2d2dce1a965b640bca4c9f28a4754cccd6f2b8d3ab3cf3f092bc59c3265bb80fe85098698c47b756c4960f17971c6dd7af4e8dd07868d541597e36923a8c61ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
df04ed160fd7d89bbafc974d46f5f848

SHA1
3bf4cb08bae01e3581ffc7419bea3f54464c4c65

SHA256
229d6fdc46eb14944b287b7e63fe4ab2c22a0790cdbd6a338b5bbd7915279073

SHA512
017a66fac5abbd81275f2c33e71b63f2ba5582820086795ad6a5b1b6bd3f6bec02071878086455fae10cac2997968254efad1f9a9b2f3b9c4fdb726391c5855b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
f788358c9e0b9822efbadd5ae53d0484

SHA1
0887399e27c23d4965bf92d3b5053651a419440a

SHA256
ae4136f8d6818e152484563515a30b297b382a8f316eda2703b3b7327892e686

SHA512
fd1aa6c45f523f44520fbcdf44d7b8995db46f04154107c8a2ae24a25d03c9d5e4b11478310246fab124f5c8afa73d5b4ea8f89f116346ffcd0d2d5f3d8e7daf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
0831cdaf71991fec48700f9560659693

SHA1
afc4bcaa94fa737696aa32bdaf7cf4f8dde983a8

SHA256
affe509131c38e82c292b80b71983754e24f7f7e848eb090dd8fd086054060b8

SHA512
94dd6fdbeaf3d82812b2826fcfa7af54fa67798ce5e159dccd66f80d16f001067baf27932ad222c6a4c3dd9a68bdf3312ebbfb782e49f2c909bc915153944515

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6fe9691d039ad2d361377d51a32bf570

SHA1
e26fb0d54131b4c116fc5b49ce63c69339c613d0

SHA256
06f2aafe1d803cb7af32b877191c35065bcf83b02ceca5168f382831cf216c92

SHA512
45ddc5b985d87a955d14180c7a431128752dd6d75195f29892e64c047acecda490555c5ad1c814646ed4a31a2d3120266438f58f52e4e3ae48e742eae197432d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
80507a12a96c87b01dbafd163c17999f

SHA1
63087a3cad994a839ba99d5c68206dad89a2c0f8

SHA256
d45870e0d9987c20a85836dcb40846e383d4221626fa5194d20384b78b798b28

SHA512
8961b39e74fc6ed0acc4f323971aa556da9e76092bc645daef02cdc40649b54e59c08e5b4e979b361781331aab2fc7fd56c131315700154ab408b0eac513e63a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e45d973e871c574028a8d4942946d992

SHA1
5e5d369d047c7b42898d70759bd583fc29926c5d

SHA256
26940a8fc0b9cee1ae15d7153b11e77cda858383bb1d791a4d393bf67f430dc3

SHA512
bb37c6c19ffc504da036d6b8e4b12c809c037eec266978084596906e88fbba10e8717776be269b05959bdbff78f93bb5e5c13bf0e2ce88706e84273eee02dff3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
1d0da1a1804e20be80d57c60c494a545

SHA1
2953e9f187708d25906010edd97caa9334dc0386

SHA256
0186f491c6afa68a2e1d9dbb1e27861ee68137ebd4ce0880f4c134bf592e5dfb

SHA512
ea5b61c2670813662beb4cbaff448602483cace2a6cf3bf75be8d53d3a1c52ec7c3ed52e454bbf000b90b9015c0e6114f16c30282b4acd7152f2fa466ddb4ec0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
227KB

MD5
c84282a7839e3cf3dd27582c197dc015

SHA1
6e75747104eeefc94010a4d00d5bf320372a1bc2

SHA256
d08b648160523caefd06dd297f0d8d2211b83a1887593750051c8c16a160606c

SHA512
72768e92cec2c6bc5c8d661d0f41ac2011268456c40823e88a5ef27a03b4de190404086de5b517eda55e7f3905e41bf089ae981c7ee8b1e3dc37941be3a418c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
227KB

MD5
aad55765526f0d971e8e7bd345fe18f6

SHA1
34d7def21ee5e6e5dd29fd1563167e4b94da0e8a

SHA256
e05d33f9a45af5f2919981c9bb08446dd8ea9d3f267746c00e1e22ed5093e3ee

SHA512
13ff32a9fcd2e50da97feb6b69bef5aa1d65d9300347c517879d02c445fc963e09921cf1108849b396001b8fdd1f3606c759fff62dee05edfb39684bda90ffcc

Download Submit
C:\Users\Admin\Downloads\Oracle_VirtualBox_Extension_Pack-7.1.2.vbox-extpack.crdownload

Filesize
21.9MB

MD5
ed4087dc0d640f47a0eb158a029d1331

SHA1
5d0e72f340c5784195f5bd7c1b825a2a405aadd9

SHA256
afd7a79ce2bd0142a890ac01f580534f1a96f1ffbaa1ad17d7512751cde19f08

SHA512
8d65de1c62fe7d4f2540a997e9fd0912b99d1561ade4e55b020700b0608f7da76d7a1b3fada413c1a742c9304e3295403ac0c9cd30bb563c56dd8a68ea36b374

Download Submit
memory/2760-342-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-341-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-330-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-332-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-331-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-337-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-336-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-338-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-339-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/2760-340-0x000001E957770000-0x000001E957771000-memory.dmp

Filesize
4KB

Download
memory/4856-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4960-113-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download
memory/4960-142-0x000001EEE3170000-0x000001EEE3180000-memory.dmp

Filesize
64KB

Download
memory/4960-48-0x000001EEE2FD0000-0x000001EEE2FE0000-memory.dmp

Filesize
64KB

Download
memory/4960-47-0x000001EEE2F30000-0x000001EEE2F40000-memory.dmp

Filesize
64KB

Download
memory/4960-43-0x000001EEE2F20000-0x000001EEE2F30000-memory.dmp

Filesize
64KB

Download
memory/4960-60-0x000001EEE3010000-0x000001EEE3020000-memory.dmp

Filesize
64KB

Download
memory/4960-63-0x000001EEE2F90000-0x000001EEE2FA0000-memory.dmp

Filesize
64KB

Download
memory/4960-62-0x000001EEE2F80000-0x000001EEE2F90000-memory.dmp

Filesize
64KB

Download
memory/4960-68-0x000001EEE3040000-0x000001EEE3050000-memory.dmp

Filesize
64KB

Download
memory/4960-67-0x000001EEE2FA0000-0x000001EEE2FB0000-memory.dmp

Filesize
64KB

Download
memory/4960-65-0x000001EEE3030000-0x000001EEE3040000-memory.dmp

Filesize
64KB

Download
memory/4960-61-0x000001EEE3020000-0x000001EEE3030000-memory.dmp

Filesize
64KB

Download
memory/4960-59-0x000001EEE2F70000-0x000001EEE2F80000-memory.dmp

Filesize
64KB

Download
memory/4960-75-0x000001EEE3060000-0x000001EEE3070000-memory.dmp

Filesize
64KB

Download
memory/4960-82-0x000001EEE3090000-0x000001EEE30A0000-memory.dmp

Filesize
64KB

Download
memory/4960-81-0x000001EEE3080000-0x000001EEE3090000-memory.dmp

Filesize
64KB

Download
memory/4960-87-0x000001EEE30B0000-0x000001EEE30C0000-memory.dmp

Filesize
64KB

Download
memory/4960-88-0x000001EEE3000000-0x000001EEE3010000-memory.dmp

Filesize
64KB

Download
memory/4960-86-0x000001EEE30A0000-0x000001EEE30B0000-memory.dmp

Filesize
64KB

Download
memory/4960-85-0x000001EEE2FF0000-0x000001EEE3000000-memory.dmp

Filesize
64KB

Download
memory/4960-94-0x000001EEE30D0000-0x000001EEE30E0000-memory.dmp

Filesize
64KB

Download
memory/4960-93-0x000001EEE30C0000-0x000001EEE30D0000-memory.dmp

Filesize
64KB

Download
memory/4960-92-0x000001EEE3020000-0x000001EEE3030000-memory.dmp

Filesize
64KB

Download
memory/4960-91-0x000001EEE3010000-0x000001EEE3020000-memory.dmp

Filesize
64KB

Download
memory/4960-80-0x000001EEE2FE0000-0x000001EEE2FF0000-memory.dmp

Filesize
64KB

Download
memory/4960-79-0x000001EEE2FD0000-0x000001EEE2FE0000-memory.dmp

Filesize
64KB

Download
memory/4960-77-0x000001EEE2FC0000-0x000001EEE2FD0000-memory.dmp

Filesize
64KB

Download
memory/4960-76-0x000001EEE3070000-0x000001EEE3080000-memory.dmp

Filesize
64KB

Download
memory/4960-74-0x000001EEE3050000-0x000001EEE3060000-memory.dmp

Filesize
64KB

Download
memory/4960-73-0x000001EEE2FB0000-0x000001EEE2FC0000-memory.dmp

Filesize
64KB

Download
memory/4960-97-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download
memory/4960-100-0x000001EEE30E0000-0x000001EEE30F0000-memory.dmp

Filesize
64KB

Download
memory/4960-99-0x000001EEE3030000-0x000001EEE3040000-memory.dmp

Filesize
64KB

Download
memory/4960-106-0x000001EEE30F0000-0x000001EEE3100000-memory.dmp

Filesize
64KB

Download
memory/4960-105-0x000001EEE3040000-0x000001EEE3050000-memory.dmp

Filesize
64KB

Download
memory/4960-109-0x000001EEE3050000-0x000001EEE3060000-memory.dmp

Filesize
64KB

Download
memory/4960-110-0x000001EEE3060000-0x000001EEE3070000-memory.dmp

Filesize
64KB

Download
memory/4960-112-0x000001EEE3100000-0x000001EEE3110000-memory.dmp

Filesize
64KB

Download
memory/4960-111-0x000001EEE3070000-0x000001EEE3080000-memory.dmp

Filesize
64KB

Download
memory/4960-55-0x000001EEE2F60000-0x000001EEE2F70000-memory.dmp

Filesize
64KB

Download
memory/4960-115-0x000001EEE3110000-0x000001EEE3120000-memory.dmp

Filesize
64KB

Download
memory/4960-120-0x000001EEE3090000-0x000001EEE30A0000-memory.dmp

Filesize
64KB

Download
memory/4960-121-0x000001EEE3120000-0x000001EEE3130000-memory.dmp

Filesize
64KB

Download
memory/4960-119-0x000001EEE3080000-0x000001EEE3090000-memory.dmp

Filesize
64KB

Download
memory/4960-124-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download
memory/4960-125-0x000001EEE3130000-0x000001EEE3140000-memory.dmp

Filesize
64KB

Download
memory/4960-128-0x000001EEE30A0000-0x000001EEE30B0000-memory.dmp

Filesize
64KB

Download
memory/4960-130-0x000001EEE3140000-0x000001EEE3150000-memory.dmp

Filesize
64KB

Download
memory/4960-129-0x000001EEE30B0000-0x000001EEE30C0000-memory.dmp

Filesize
64KB

Download
memory/4960-135-0x000001EEE3150000-0x000001EEE3160000-memory.dmp

Filesize
64KB

Download
memory/4960-138-0x000001EEE3160000-0x000001EEE3170000-memory.dmp

Filesize
64KB

Download
memory/4960-137-0x000001EEE30D0000-0x000001EEE30E0000-memory.dmp

Filesize
64KB

Download
memory/4960-136-0x000001EEE30C0000-0x000001EEE30D0000-memory.dmp

Filesize
64KB

Download
memory/4960-53-0x000001EEE2F50000-0x000001EEE2F60000-memory.dmp

Filesize
64KB

Download
memory/4960-143-0x000001EEE30E0000-0x000001EEE30F0000-memory.dmp

Filesize
64KB

Download
memory/4960-144-0x000001EEE3180000-0x000001EEE3190000-memory.dmp

Filesize
64KB

Download
memory/4960-148-0x000001EEE3190000-0x000001EEE31A0000-memory.dmp

Filesize
64KB

Download
memory/4960-150-0x000001EEE3100000-0x000001EEE3110000-memory.dmp

Filesize
64KB

Download
memory/4960-149-0x000001EEE31A0000-0x000001EEE31B0000-memory.dmp

Filesize
64KB

Download
memory/4960-147-0x000001EEE30F0000-0x000001EEE3100000-memory.dmp

Filesize
64KB

Download
memory/4960-154-0x000001EEE3110000-0x000001EEE3120000-memory.dmp

Filesize
64KB

Download
memory/4960-157-0x000001EEE3120000-0x000001EEE3130000-memory.dmp

Filesize
64KB

Download
memory/4960-156-0x000001EEE31C0000-0x000001EEE31D0000-memory.dmp

Filesize
64KB

Download
memory/4960-155-0x000001EEE31B0000-0x000001EEE31C0000-memory.dmp

Filesize
64KB

Download
memory/4960-160-0x000001EEE3130000-0x000001EEE3140000-memory.dmp

Filesize
64KB

Download
memory/4960-164-0x000001EEE31E0000-0x000001EEE31F0000-memory.dmp

Filesize
64KB

Download
memory/4960-162-0x000001EEE3140000-0x000001EEE3150000-memory.dmp

Filesize
64KB

Download
memory/4960-161-0x000001EEE31D0000-0x000001EEE31E0000-memory.dmp

Filesize
64KB

Download
memory/4960-165-0x000001EEE3150000-0x000001EEE3160000-memory.dmp

Filesize
64KB

Download
memory/4960-167-0x000001EEE31F0000-0x000001EEE3200000-memory.dmp

Filesize
64KB

Download
memory/4960-166-0x000001EEE3160000-0x000001EEE3170000-memory.dmp

Filesize
64KB

Download
memory/4960-169-0x000001EEE3200000-0x000001EEE3210000-memory.dmp

Filesize
64KB

Download
memory/4960-171-0x000001EEE3170000-0x000001EEE3180000-memory.dmp

Filesize
64KB

Download
memory/4960-172-0x000001EEE3210000-0x000001EEE3220000-memory.dmp

Filesize
64KB

Download
memory/4960-175-0x000001EEE3220000-0x000001EEE3230000-memory.dmp

Filesize
64KB

Download
memory/4960-174-0x000001EEE3180000-0x000001EEE3190000-memory.dmp

Filesize
64KB

Download
memory/4960-183-0x000001EEE3230000-0x000001EEE3240000-memory.dmp

Filesize
64KB

Download
memory/4960-182-0x000001EEE31A0000-0x000001EEE31B0000-memory.dmp

Filesize
64KB

Download
memory/4960-181-0x000001EEE3190000-0x000001EEE31A0000-memory.dmp

Filesize
64KB

Download
memory/4960-185-0x000001EEE3240000-0x000001EEE3250000-memory.dmp

Filesize
64KB

Download
memory/4960-192-0x000001EEE31C0000-0x000001EEE31D0000-memory.dmp

Filesize
64KB

Download
memory/4960-56-0x000001EEE3000000-0x000001EEE3010000-memory.dmp

Filesize
64KB

Download
memory/4960-54-0x000001EEE2FF0000-0x000001EEE3000000-memory.dmp

Filesize
64KB

Download
memory/4960-49-0x000001EEE2FE0000-0x000001EEE2FF0000-memory.dmp

Filesize
64KB

Download
memory/4960-50-0x000001EEE2F40000-0x000001EEE2F50000-memory.dmp

Filesize
64KB

Download
memory/4960-44-0x000001EEE2FC0000-0x000001EEE2FD0000-memory.dmp

Filesize
64KB

Download
memory/4960-40-0x000001EEE2CB0000-0x000001EEE2F20000-memory.dmp

Filesize
2.4MB

Download
memory/4960-41-0x000001EEE2FB0000-0x000001EEE2FC0000-memory.dmp

Filesize
64KB

Download
memory/4960-38-0x000001EEE2FA0000-0x000001EEE2FB0000-memory.dmp

Filesize
64KB

Download
memory/4960-35-0x000001EEE2F80000-0x000001EEE2F90000-memory.dmp

Filesize
64KB

Download
memory/4960-36-0x000001EEE2F90000-0x000001EEE2FA0000-memory.dmp

Filesize
64KB

Download
memory/4960-32-0x000001EEE2F70000-0x000001EEE2F80000-memory.dmp

Filesize
64KB

Download
memory/4960-30-0x000001EEE2F60000-0x000001EEE2F70000-memory.dmp

Filesize
64KB

Download
memory/4960-28-0x000001EEE2F50000-0x000001EEE2F60000-memory.dmp

Filesize
64KB

Download
memory/4960-26-0x000001EEE2F40000-0x000001EEE2F50000-memory.dmp

Filesize
64KB

Download
memory/4960-24-0x000001EEE2F30000-0x000001EEE2F40000-memory.dmp

Filesize
64KB

Download
memory/4960-22-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download
memory/4960-21-0x000001EEE2F20000-0x000001EEE2F30000-memory.dmp

Filesize
64KB

Download
memory/4960-12-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download
memory/4960-3-0x000001EEE2CB0000-0x000001EEE2F20000-memory.dmp

Filesize
2.4MB

Download
memory/4960-191-0x000001EEE31B0000-0x000001EEE31C0000-memory.dmp

Filesize
64KB

Download
memory/4960-203-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download
memory/4960-229-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download
memory/4960-246-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download
memory/4960-268-0x000001EEE1460000-0x000001EEE1461000-memory.dmp

Filesize
4KB

Download