hijackloader | 55747e5ff5b95088ace5e7b529bd1c0190acf8c23bd4c20f215c42b023238852

Analysis

max time kernel
90s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
submitted
10-11-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56078814b6ce3536d4a4040e5dc3840a.exe
Size

3.7MB
MD5

56078814b6ce3536d4a4040e5dc3840a
SHA1

da7c81230f212e32dfc62de9114a4d0fb1c5930d
SHA256

55747e5ff5b95088ace5e7b529bd1c0190acf8c23bd4c20f215c42b023238852
SHA512

e00bce379212438e501e2f027aadddbf8a07fd1b9a18b8cc3b0f8e2323a0010ba0dffee584889d1bfbc13e662b86ffac5911b2c17163abb1531387c36ef56251
SSDEEP

98304:A6+OyDN0KCiRrvf7aKpePMcDLEj2Jel4iUf:sOyrrvf7AE23ellm

Score

10^/10

hijackloader stealc xprivate28 credential_access discovery loader spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

xprivate28

http://83.222.191.225

Attributes

url_path
/31c11d12f15e92b7.php

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/memory/2164-1-0x0000000000400000-0x00000000007B4000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 10 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4984	chrome.exe
4304	msedge.exe
3496	msedge.exe
4408	chrome.exe
536	chrome.exe
4504	chrome.exe
4076	chrome.exe
5104	msedge.exe
3260	msedge.exe
4384	msedge.exe

Deletes itself 1 IoCs

pid	Process
3276	cmd.exe

Loads dropped DLL 3 IoCs

pid	Process
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 3276	2164	56078814b6ce3536d4a4040e5dc3840a.exe	85

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56078814b6ce3536d4a4040e5dc3840a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4416	timeout.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133757122097820168"	chrome.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2164	56078814b6ce3536d4a4040e5dc3840a.exe
2164	56078814b6ce3536d4a4040e5dc3840a.exe
3276	cmd.exe
3276	cmd.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
4408	chrome.exe
4408	chrome.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
3024	explorer.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
1772	msedge.exe
1772	msedge.exe
5104	msedge.exe
5104	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
2412	msedge.exe
3024	explorer.exe
3024	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2164	56078814b6ce3536d4a4040e5dc3840a.exe
3276	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe
Token: SeShutdownPrivilege	4408	chrome.exe
Token: SeCreatePagefilePrivilege	4408	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
4408	chrome.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 3276	2164	56078814b6ce3536d4a4040e5dc3840a.exe	85
PID 2164 wrote to memory of 3276	2164	56078814b6ce3536d4a4040e5dc3840a.exe	85
PID 2164 wrote to memory of 3276	2164	56078814b6ce3536d4a4040e5dc3840a.exe	85
PID 2164 wrote to memory of 3276	2164	56078814b6ce3536d4a4040e5dc3840a.exe	85
PID 3276 wrote to memory of 3024	3276	cmd.exe	105
PID 3276 wrote to memory of 3024	3276	cmd.exe	105
PID 3276 wrote to memory of 3024	3276	cmd.exe	105
PID 3276 wrote to memory of 3024	3276	cmd.exe	105
PID 3024 wrote to memory of 4408	3024	explorer.exe	109
PID 3024 wrote to memory of 4408	3024	explorer.exe	109
PID 4408 wrote to memory of 4404	4408	chrome.exe	110
PID 4408 wrote to memory of 4404	4408	chrome.exe	110
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 384	4408	chrome.exe	111
PID 4408 wrote to memory of 4560	4408	chrome.exe	112
PID 4408 wrote to memory of 4560	4408	chrome.exe	112
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113
PID 4408 wrote to memory of 2280	4408	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\56078814b6ce3536d4a4040e5dc3840a.exe
"C:\Users\Admin\AppData\Local\Temp\56078814b6ce3536d4a4040e5dc3840a.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\SysWOW64\cmd.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdf605cc40,0x7ffdf605cc4c,0x7ffdf605cc58
        5⤵
        
        PID:4404
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2016,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2012 /prefetch:2
        5⤵
        
        PID:384
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1860,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:3
        5⤵
        
        PID:4560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2160,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2584 /prefetch:8
        5⤵
        
        PID:2280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3200,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3208 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3256 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3636,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4552 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3192,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4604 /prefetch:8
        5⤵
        
        PID:3488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4756,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4444 /prefetch:8
        5⤵
        
        PID:1416
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4888,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:8
        5⤵
        
        PID:976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4788,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:8
        5⤵
        
        PID:3392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5088,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4800 /prefetch:8
        5⤵
        
        PID:4124
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5108,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5116 /prefetch:8
        5⤵
        
        PID:4564
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4620,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:8
        5⤵
        
        PID:2880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5068,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5248 /prefetch:8
        5⤵
        
        PID:3280
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5220,i,6925017444541652414,13325016208838960460,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5176 /prefetch:2
        5⤵
        Uses browser remote debugging
        
        PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:5104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf60646f8,0x7ffdf6064708,0x7ffdf6064718
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        5⤵
        
        PID:3404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
        5⤵
        
        PID:1180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3960 /prefetch:2
        5⤵
        
        PID:4076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3968 /prefetch:2
        5⤵
        
        PID:320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,17883488029021972771,10997780051390187295,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2756 /prefetch:2
        5⤵
        
        PID:2036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\SysWOW64\explorer.exe" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:744
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4416

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\chrome.dll

Filesize
676KB

MD5
eda18948a989176f4eebb175ce806255

SHA1
ff22a3d5f5fb705137f233c36622c79eab995897

SHA256
81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

SHA512
160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
3cbf3586275643b5c6f5b7d7d2bb9490

SHA1
c494779040721cb8b8feb85ca7de667d6a57d90e

SHA256
be73dc7673464739cafe6d99f264d2af9c4c965ddeb5d870ed9cd74dca0d96b3

SHA512
52fb24f7cf565b62849106c3799c7c5ffc659e777d73ab18c0f104cdd3a21e8e3ccbe933067e6b0761d845778a97b257c6d6ffde718faa0abbfe355c50d16d3e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\687eb797-0346-44de-8431-a47c7babec78.dmp

Filesize
842KB

MD5
bc6ee187b110607db9f21f735f924c15

SHA1
2e17a9d541388d5b54355faefdbfd98798f473d3

SHA256
e382ce9daa639b7b338bf5a823515da20eea2bca93fa367e805293199fd12b34

SHA512
1f4de965fb3b5717cd75300a22dc3e69df0e5368b747617ea2f5ec3fe2bfacca614c6706c4ef942924851c32f5933cf75d225efa39a6baa67f298194ac6e1522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\e485626d-652f-4766-9d9d-0b608832406a.dmp

Filesize
838KB

MD5
46f62b1405ff6240ee474d5ece318667

SHA1
d81cbb1c155d5ab6e4b64bbfba0c2818fbee47ce

SHA256
04195d47e0e38112fdbe821dbdb2e2948553dffd29e2fb2df7dfde28c06de2fe

SHA512
f5378953492ff7195b7461ef9de2699edb39198cf1b3d3880a15b038061b3e095c72cacc2db558a56c7b0858122d8c7c4e1749cfc3070a89545c199e45fb3a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f1370992-2791-4167-b1bd-e5be89820cac.dmp

Filesize
822KB

MD5
cbd1fe9bce69ee7bed2f455ec1a15fee

SHA1
29e68c96554795251a4da9f7683102912b0eb014

SHA256
fd9122d23ed3f66dea2ba9681deaacaf8a7453564b096c4df39c91ae8d6d8a82

SHA512
22d78f71ce2af4a44fc7b98241333d6403bdea9046d1d951ac42e2269a577f96b7975f4910bba6e2cfdc53aeff8dfa6f5dee95a3d3d0a200c91a5e411e5f37bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8762a30e676b3a4465dd82da271d2423

SHA1
08ac317550c1ca4a8c9771eb4767fbcfbce116c0

SHA256
449547f86a7e8f5a294b43b9d92d6583abe6b18e240abc7d4d2b1892a012da6a

SHA512
2f3c971830ec749eeff7846d6bc1d49e3b279d0602f1d1cd2936f2cebd8bbf5a1881bda67dcc0870ecb650688529396ec41e8650b121e4a590a057c69c1baae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a4c0a7bdee3f6ed91a9f413e35ef0614

SHA1
f66130797588e50affc1710adf02fd16d0d4635a

SHA256
3a88b6d90e34ed2af8d829fe9627daa121b8cc81ca1be3eb685f7a470be094c9

SHA512
d27a6f2abbf969c56a376b54efdb130a2991c15deabd07ffde58edf3b8487f0be31e94a8e269a82beb4aa8956d2a35c1b40d4fe440b8fda972c677e7e23171a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c6754b3-4be7-49ba-b022-83bde8d09952.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89081cd11590c72e7c996ce5e656b659

SHA1
933b79af2b9caba1faa48253e061a9555e6a1c48

SHA256
e7fbaf6b712190f5913b0aa559b877f167cac9fd044a3669ab3f96b996948deb

SHA512
9b60d1e14be8110462880b2140199e36b73c39603502799fe2d9a99a1cbb5870de0da9155bb025e9337338c13424942dd3fe4996b8f53b9857530c681960a593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\79b12c10

Filesize
1.5MB

MD5
4e75a62edcd09e97379d755ce12d8c2b

SHA1
e38b88edaf95041e61fd49c39a163ce14ac473fa

SHA256
a2e823268ac756196bb6871552bec89b59d7f152edbb3d881b3ad12f5e03fd7e

SHA512
e694dd5a2e9fdbf71f75e3438ebab686917be16812e413c6e3161fab7ffbb4f21b633640874641dd4989e7e78f757c5f98b661180fc3d8b2454413c155cc2414

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4408_149777499\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4408_149777499\b25a02e4-3318-4b82-a894-3dfb8a5a1873.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
memory/2164-6-0x00000000753F0000-0x000000007556B000-memory.dmp

Filesize
1.5MB

Download
memory/2164-1-0x0000000000400000-0x00000000007B4000-memory.dmp

Filesize
3.7MB

Download
memory/2164-2-0x00000000753F0000-0x000000007556B000-memory.dmp

Filesize
1.5MB

Download
memory/2164-3-0x00007FFE153B0000-0x00007FFE155A5000-memory.dmp

Filesize
2.0MB

Download
memory/2164-4-0x0000000075403000-0x0000000075405000-memory.dmp

Filesize
8KB

Download
memory/2164-0-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/2164-5-0x00000000753F0000-0x000000007556B000-memory.dmp

Filesize
1.5MB

Download
memory/3024-18-0x0000000000C00000-0x0000000000EEE000-memory.dmp

Filesize
2.9MB

Download
memory/3024-16-0x0000000000C00000-0x0000000000EEE000-memory.dmp

Filesize
2.9MB

Download
memory/3024-658-0x0000000000C00000-0x0000000000EEE000-memory.dmp

Filesize
2.9MB

Download
memory/3024-77-0x0000000000C00000-0x0000000000EEE000-memory.dmp

Filesize
2.9MB

Download
memory/3024-509-0x0000000000C00000-0x0000000000EEE000-memory.dmp

Filesize
2.9MB

Download
memory/3024-24-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3024-23-0x00000000005A0000-0x00000000009D3000-memory.dmp

Filesize
4.2MB

Download
memory/3024-22-0x0000000000683000-0x000000000068B000-memory.dmp

Filesize
32KB

Download
memory/3024-17-0x00007FFE153B0000-0x00007FFE155A5000-memory.dmp

Filesize
2.0MB

Download
memory/3276-15-0x00000000753F0000-0x000000007556B000-memory.dmp

Filesize
1.5MB

Download
memory/3276-8-0x00000000753F0000-0x000000007556B000-memory.dmp

Filesize
1.5MB

Download
memory/3276-11-0x00007FFE153B0000-0x00007FFE155A5000-memory.dmp

Filesize
2.0MB

Download
memory/3276-12-0x00000000753F0000-0x000000007556B000-memory.dmp

Filesize
1.5MB

Download
memory/3276-13-0x00000000753F0000-0x000000007556B000-memory.dmp

Filesize
1.5MB

Download