944ef2c62506efbcbd27d579ff3ff1353dfb2258cfcafd4813d05c4e51ebbf2b

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2025, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c986fd191480dd53fe2b1c6f0d689ee5.exe
Size 17.4MB
Sample250326-hyxpgssms7
SHA256 944ef2c62506efbcbd27d579ff3ff1353dfb2258cfcafd4813d05c4e51ebbf2b
MD5 c986fd191480dd53fe2b1c6f0d689ee5
SHA1 39896aa5ed4d7bce42a68d83427b323f82e4b66e
SHA512 bf86577a35e3da1854d694f074a6f63c41e838cffa6c45f6965685897009b8dbb23be8785241013e1ab69a35c21262d0590d70eef060802062d11d682823aeeb
SSDEEP 393216:sp789W6XI+4TufDp8p7sHuJgyOei1pOU55jQEjC7sQASv4hJjheP+8:s5gWKv9SAEgyM7OMyEjC7/v4DqH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5812	c986fd191480dd53fe2b1c6f0d689ee5.exe
2196	Riffstation.exe
4720	Riffstation.exe

Loads dropped DLL 23 IoCs

pid	Process
5812	c986fd191480dd53fe2b1c6f0d689ee5.exe
2196	Riffstation.exe
2196	Riffstation.exe
2196	Riffstation.exe
2196	Riffstation.exe
2196	Riffstation.exe
2196	Riffstation.exe
2196	Riffstation.exe
2196	Riffstation.exe
2196	Riffstation.exe
2196	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
1892	JJValid_test.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 4992	4720	Riffstation.exe	93

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c986fd191480dd53fe2b1c6f0d689ee5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c986fd191480dd53fe2b1c6f0d689ee5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Riffstation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Riffstation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2196	Riffstation.exe
4720	Riffstation.exe
4720	Riffstation.exe
4992	cmd.exe
4992	cmd.exe
1892	JJValid_test.exe
1892	JJValid_test.exe
4532	chrome.exe
4532	chrome.exe
1892	JJValid_test.exe
1892	JJValid_test.exe
1892	JJValid_test.exe
1892	JJValid_test.exe
1892	JJValid_test.exe
1892	JJValid_test.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4720	Riffstation.exe
4992	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe
Token: SeShutdownPrivilege	4532	chrome.exe
Token: SeCreatePagefilePrivilege	4532	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe
4532	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 5812	1812	c986fd191480dd53fe2b1c6f0d689ee5.exe	89
PID 1812 wrote to memory of 5812	1812	c986fd191480dd53fe2b1c6f0d689ee5.exe	89
PID 1812 wrote to memory of 5812	1812	c986fd191480dd53fe2b1c6f0d689ee5.exe	89
PID 5812 wrote to memory of 2196	5812	c986fd191480dd53fe2b1c6f0d689ee5.exe	91
PID 5812 wrote to memory of 2196	5812	c986fd191480dd53fe2b1c6f0d689ee5.exe	91
PID 5812 wrote to memory of 2196	5812	c986fd191480dd53fe2b1c6f0d689ee5.exe	91
PID 2196 wrote to memory of 4720	2196	Riffstation.exe	92
PID 2196 wrote to memory of 4720	2196	Riffstation.exe	92
PID 2196 wrote to memory of 4720	2196	Riffstation.exe	92
PID 4720 wrote to memory of 4992	4720	Riffstation.exe	93
PID 4720 wrote to memory of 4992	4720	Riffstation.exe	93
PID 4720 wrote to memory of 4992	4720	Riffstation.exe	93
PID 4720 wrote to memory of 4992	4720	Riffstation.exe	93
PID 4992 wrote to memory of 1892	4992	cmd.exe	108
PID 4992 wrote to memory of 1892	4992	cmd.exe	108
PID 4992 wrote to memory of 1892	4992	cmd.exe	108
PID 4992 wrote to memory of 1892	4992	cmd.exe	108
PID 1892 wrote to memory of 4532	1892	JJValid_test.exe	114
PID 1892 wrote to memory of 4532	1892	JJValid_test.exe	114
PID 4532 wrote to memory of 4724	4532	chrome.exe	115
PID 4532 wrote to memory of 4724	4532	chrome.exe	115
PID 4532 wrote to memory of 4764	4532	chrome.exe	116
PID 4532 wrote to memory of 4764	4532	chrome.exe	116
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 4776	4532	chrome.exe	117
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120
PID 4532 wrote to memory of 6132	4532	chrome.exe	120

C:\Users\Admin\AppData\Local\Temp\c986fd191480dd53fe2b1c6f0d689ee5.exe
"C:\Users\Admin\AppData\Local\Temp\c986fd191480dd53fe2b1c6f0d689ee5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\Temp\{429BD8C1-34B1-4823-938F-3DB1E821E332}\.cr\c986fd191480dd53fe2b1c6f0d689ee5.exe
  "C:\Windows\Temp\{429BD8C1-34B1-4823-938F-3DB1E821E332}\.cr\c986fd191480dd53fe2b1c6f0d689ee5.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\c986fd191480dd53fe2b1c6f0d689ee5.exe" -burn.filehandle.attached=532 -burn.filehandle.self=544
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\Riffstation.exe
    C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\Riffstation.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\Users\Admin\AppData\Roaming\ChromeArchive_JVT_alpha\Riffstation.exe
      C:\Users\Admin\AppData\Roaming\ChromeArchive_JVT_alpha\Riffstation.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\JJValid_test.exe
        
        C:\Users\Admin\AppData\Local\Temp\JJValid_test.exe
        6⤵
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1892
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        7⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9812cdcf8,0x7ff9812cdd04,0x7ff9812cdd10
        8⤵
        
        PID:4724
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1964,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2108 /prefetch:3
        8⤵
        
        PID:4764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2080,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2076 /prefetch:2
        8⤵
        
        PID:4776
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2376,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2560 /prefetch:8
        8⤵
        
        PID:6120
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3000,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3044 /prefetch:1
        8⤵
        
        PID:5920
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3048,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3084 /prefetch:1
        8⤵
        
        PID:6132
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4312,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4328 /prefetch:2
        8⤵
        
        PID:1672
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4808,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4716 /prefetch:1
        8⤵
        
        PID:1776
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5524,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5504 /prefetch:8
        8⤵
        
        PID:688
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5528,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5560 /prefetch:8
        8⤵
        
        PID:3408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5536,i,223423030979445383,15081054903230387262,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5600 /prefetch:8
        8⤵
        
        PID:5052

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1628

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1097421162f9ca27c7061b86f7913d3515542f62dfe8d8c2b172ac1600246113
MD5 4026cbfbe3f2646dec934d7717077b44
SHA1 510bc0569b691d680ff873094f3ab58b94adc464
SHA512 c4959be888920c6acff0679c9e71d1582d81521f02297ec64c24960da0c747bd0f9aa70bdaea7b8a31e96b3816f3d6cd66644c7160adebb14650d8d3d7695a33
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 0981037ace6b129420349a29ed11f4dd1e89e08f6fdceef2e220ea6e64ae769c
MD5 6a7e0f3f4bfd051edeed982c55137663
SHA1 3ef1997c2c245a8936fe26a37b555996477f1ead
SHA512 7c7ce0897b61d14843320070e1fdeeece6603c312a7e86e82d503e193c51f0728d51cfa104efab2d64c10bcdfe244de7dcecd4237510417219241dc95fefbd30
SSDEEP 192:5YYcSrMxWqtJZ8PRpk3HS+WNFOZoxXW2aDplkw7pQyIsnA/g4:5YYcL8qkXkXc0Zoxm2Qj9Z4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 5d511999212f1e6d398dd54480ab00f7ac2b53006d7925d2c515c429f9fc9c6d
MD5 4865523dfbe62a2d17bdbcc426d6deba
SHA1 c6e849ffef3035d7e069923652f90c68f686206d
SHA512 5fbe07cb1566867356fa796987ce8011e9333c7f1647bb61796672da514eb2084db54f07e47ba08fbd39e72eccfde7fbd60991c79733a5a5c7e724ca6e189499
SSDEEP 384:WyUk17pLuLcwV+zXENPkXqKf/pUZNCgVLH2Hf1iTrUOWhHG2JaIw7r:WPI7pLuLtMbENPkXqKf/pUZNCgVLH2Hm
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b24e2442ecaa000e9fc82d9b1c3a955ea61a972f5964c80f1bc7509cb5fd6014
MD5 335c166fef87add4e60a68d70f60ab23
SHA1 716188cf9309ca340ab0bff55422242aebda4f74
SHA512 269c801d3e10561c0b600dfbc3ceff427ca3e1b81e453738130332cc5254b010c1f498cd251ecd6c8cdc8da2e4e6d36a274b293b07eb2c9ede45475a9a3577df
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe58c4e1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c4e1.TMP
Size 48B
SHA256 57fad50350ee3741e7a5f7c6dd2e42324dd3d157af3ea8f52659883d2fb9f160
MD5 1c7ca653f84330320619b2fc4edb859a
SHA1 f0d4a4aaa944ad37640df816d8f18bff55a779ea
SHA512 f0dfb920ee69ef134ef694c557453a350a1ece6bcf8846f390c5750d63042513059fce24f1e3c96c0a0cc2bfd05e929df42364c4733075db2e95e1c2b3ed37b0
MD5 SHA1 SHA512

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 7114eaf0a021d2eb098b1e9f56f3500dc4f74ac68a87f5256922e4a4b9fa66b7
MD5 a4710a30ca124ef24daf2c2462a1da92
SHA1 96958e2fe60d71e08ea922dfd5e69a50e38cc5db
SHA512 43878e3bc6479df9e4ebd11092be61a73ab5a1441cd0bc8755edd401d37032c44a7279bab477c01d563ab4fa5d8078c0ba163a9207383538e894e0a7ff5a3e15
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 81KB
SHA256 26542db8293ed33257de627f1d2eccc4a18f01e0161688bf73d6a4edd296ae6a
MD5 d792864b68c2bc2b80c76b52f8d746af
SHA1 902cf092976191268e8b0a448e1dba6f84a4324c
SHA512 ac563940714aea586caf8e063c011391690f7c39ac6e6d88ef967c1cd95fd1239b386d30c33e2910ec15670d78e88a65d123f309353694551825bd3afc5168a2
SSDEEP 1536:FEMiNjdpr3nOOJZd5d3Apv/x49GeaJTNnoV7SadJAfAkP3/2HNHGUrq+x:ziFD3laXx49GdfoV7S6JAYkP/s8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 80KB
SHA256 6fb76707b5e1b7509dddd9c22fdfce812d7474d639978ba2bdd683606ae97a7e
MD5 65da800b362c3aa0f1276a3a602436f7
SHA1 4f812d1c3ee0d6a1e46e589d5ae2c22d774bc6fd
SHA512 2748a7d7fd76605e3024d943dc8ca8c9e8c2c8c8a919a90172cb04c6995b0fc226cf5d7567555142d6b17c48b8eccd79bfc8d57a8f3bd2482608bece4e6c4c24
SSDEEP 1536:18JNjdpr3nOOJZd5d3Apv/x49GeaJTNnoV7SadJAfAkP3/2HNHGUrq+U:8FD3laXx49GdfoV7S6JAYkP/s8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 81KB
SHA256 cd04a027f0af7cb3afcdb9e5aa9a93e75d6ce8b31b3b152a737c5f7a3e5e48bc
MD5 c5465ccad9f698d7ce9dab32c3bec6c8
SHA1 6891992ac9e14a52179fa6c89942ba74e2edeb84
SHA512 aaf85368447ca0debbcba1d70c01df7552c54812f351dc89c89485822ab3f1df709619ad74d6bcf11cc3974f21d5170de291c824a2a88ce357836458c7af5fbe
SSDEEP 1536:0EMiNjdpr3nOOJZd5d3Apv/x49GeaJTNnoV7SadJAfAkP3/2HNHGUrq+x:wiFD3laXx49GdfoV7S6JAYkP/s8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

JJValid_test.exe

Path C:\Users\Admin\AppData\Local\Temp\JJValid_test.exe
Size 2.3MB
SHA256 b22bf1210b5fd173a210ebfa9092390aa0513c41e1914cbe161eb547f049ef91
MD5 967f4470627f823f4d7981e511c9824f
SHA1 416501b096df80ddc49f4144c3832cf2cadb9cb2
SHA512 8883ead428c9d4b415046de9f8398aa1f65ae81fe7945a840c822620e18f6f9930cce2e10acff3b5da8b9c817ade3dabc1de576cbd255087267f77341900a41c
SSDEEP 49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
MD5 SHA1 SHA512 SSDEEP

Submit Download

c967a95b

Path C:\Users\Admin\AppData\Local\Temp\c967a95b
Size 5.4MB
SHA256 1e70af279d6d03a1b41128d6e21d9baa84d76575350819ff123446650077ef69
MD5 ec4c4f03e346c951099aa5f5d6ff3c93
SHA1 12c1715497f9dae6f722884d14fa153a4ca58ff7
SHA512 3b6de9a5d0b2dbabd03204d8eeb08e05ff30a131a10a9608ecb1d8144edff04778d5e06ad704cd7e0f060c4a5aaf9b10195195ef83fa371595b163a200f3ee57
SSDEEP 98304:8Rx6BbvoZ0TCrPWrO2dkyvjtm1GtHUp6hxAUvvMYNktxymwKa1MYXlOr/R4OnLrT:8Rx6hwsCrP2Fm1CNXlsZPd82fjNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Assai.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\Assai.dll
Size 91KB
SHA256 d2084a1df72d4f60803652bfa180e43553dc76706794a62ff8fd69e444c913e1
MD5 3279c9c4cc98efd8d8e1663399ccaa16
SHA1 32f3da89334521b61b28baa18b2b61f41cae76f6
SHA512 2652129c104a42df5c05bfd2f1e8d36dc646e1d41dda0bd05e578befa9db5829bd5f9c22fb5069e90e4c0f328f958ef326c55aaae3805d7045cfdc2f09b71d1e
SSDEEP 1536:wR30C47BrnWZ9ZLHhP+l/9nFovaYNvrgsWHcd5TsyBR/JnAaUuY6zr:wR3ArWZ9LP+wdH5TsSR/JnAaN/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Core.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\Qt5Core.dll
Size 5.9MB
SHA256 cbcf0f796030018dafb532b964106046411dfcf2deec1541752a25e9ead06409
MD5 80744f50b12045842c5bf246affecc82
SHA1 8e267885bbd5533b18c339dfb407622ac640198b
SHA512 28bd00e2e20f6fffde43c562f07ca1512ca0d0971aa55678d40c72e40132a6c20bdddfb0ded89c73f3c16c92a623964de6b98e2e79feea196a0328a828bd1e37
SSDEEP 98304:JHb7DAJNX5V8y/8oLImDrlnjStnpa2yJsv6tWKFdu9CklT74u:hfArjrf/gpafJsv6tWKFdu9Ckl7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Gui.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\Qt5Gui.dll
Size 6.1MB
SHA256 8f7c29d0c656b515f30870cca2666b6e9bc1be0152a64afabce19b1ada508ad7
MD5 8d28f304e1266da7a1d4bc53f57b0d66
SHA1 402f190c40db877285d1cf079f7785f22dc6b487
SHA512 ed65f2f7466ae1c6eaeab6a917527e4483b4ea87dbc3c9641cd7437537e20fb5894bcbf39f557fe05f9520cba610a1c02327d9402d460e4dff91aebf47c840bf
SSDEEP 98304:8kwD8l4lx3fcjSCTLhXAeGNCx5Kb6MzUmzh23FEJpdlc9zjro7rgoi57UFpBJs/C:ru8ok6nYtgmUFqax
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Widgets.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\Qt5Widgets.dll
Size 5.9MB
SHA256 9829bdf2eb6d19f523c0c0306ea8f41afdc478635430695c2e016fdf0a025858
MD5 58e7f25df568d859dabbbd490de94dfd
SHA1 099a63ebdd691fc6b01fa798e859ff651feba58d
SHA512 6016e7f9f88faf0e9802daf141a8af3f41ed52ec7d6c869fddd6117ddc2289460e6934e015ac0e50659a2bcc2c75dedac267d770a2cac51f017171112b1bbbec
SSDEEP 98304:kjk64o1mNUoWwBIZMY9ZRs5+4FlESDcX+1rwha76mNeofuMFc6wmW8XrTkeq8GFM:gwH1LVU87
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qt5Xml.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\Qt5Xml.dll
Size 211KB
SHA256 8fbd5c6eb2010aa6a1a84532565c55c407b2f8c64305771a7f27ec36c85d2258
MD5 57ebe237c23b246d5822dcd6b4a0748d
SHA1 260850f8acbc7f87b1f1d5c5c4ad4e15026ec725
SHA512 4601c8a54cec60f213c929e32c27027ddfaeab1d89db78261a5d561dc07600d1d0edbfb2c5348bb68b2eb7dd501da5ee4d4e0af4572711d2517aa65b78953b45
SSDEEP 3072:6VIhfFibDt9nYEPHAtMr+btmgNUPq2HuOwFUArSb1jCi2azuDpEWFF:6Vkf5EPHtqbtmg+fr9H2aSEW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Riffstation.exe

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\Riffstation.exe
Size 6.2MB
SHA256 48812eeb0a36b1cbdaa28d3c2f8d50726a6fb3d1c6aa6d5483e8e455b3630067
MD5 0f00c8b026148991862be9f30cfc609e
SHA1 ee22ae46714cfebf4c1b800df06cf26668934546
SHA512 ba87b0e75fa52aba5a73e957f82482c3ce7389c149aaaf211bf726a4abef5bdc72deff3d49f336e6b928806379ff4f5d96873cc9a63d67c3e9b032f0d09bd5a5
SSDEEP 196608:2/1aSVxuz1t8DSWRgw/Rndh3JyIvrcKFmfSJqaWhpm34:OA3QxRLZdvrcAvr34
MD5 SHA1 SHA512 SSDEEP

Submit Download

bass.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\bass.dll
Size 105KB
SHA256 a3b00967d5c4ef1a2b4980183934d46ef36cee4b3dc1b2a6da1f820d63448390
MD5 9586e7be6ae8016932038932d1417241
SHA1 1581bd3d522c083e721f3c190e56b95a935580e0
SHA512 f99957b01b94cf895641f69bf4788be4496073f054b4cd7c8171f56c15e963ebbb7ee5ca38e2cc9cb651a733b03458344382c41b535c576e0d49a7ba07b672fb
SSDEEP 3072:tyYiAB2IFLa2e/GFMx8lU5gKDkjm76wdX:tjBNN+G6TKKAqnd
MD5 SHA1 SHA512 SSDEEP

Submit Download

bassenc.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\bassenc.dll
Size 16KB
SHA256 3b24b567fe34c59e6f77c7fc99e7b47eeedf4606bb3a35ef2a6118e4a8ca386c
MD5 efd43a932ff1f7169d0fa65e09cc75ea
SHA1 0bfdae7b0e45d4cbb18acc1c188c48c23b464891
SHA512 1b9dfd9f6fae00341059aa1bc453fa987166b726de3d78aa71c7c4bb40884b3bea340bd86d2e373d5045d9b9cc140b457772129e0cbffb686f9c0775ad63258f
SSDEEP 384:vrqeDZyhpq1vwhIToCS47jZ9zqfz1gf8oQMZM:Bq0o+0Ct7jZ9ur1gTZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

libgcc_s_dw2-1.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\libgcc_s_dw2-1.dll
Size 117KB
SHA256 4d2e2d408d399d066b0aaef2047f7a33515c13c589832de0d9f1ba87a530c394
MD5 043b39434829ce93637b1801d57b2082
SHA1 297b5f72104130e17d92789adbbcfab8fe700a82
SHA512 eee912b21d31c54bf913d11028f1637a041809bbe4cd6a5ca28c664f72b397d67d03230ba652a06b86916aea7e7ff5999a5b26cc14c067ab1652ab82f565edcf
SSDEEP 1536:8dtiUW76b2IPdo20ERT/TAnckgPfwxsNSGcHy//Rs0l6eeyB0nN0x/W08mZ9DxRw:8G66yo2zT/TGgXsavs0MdmxRw
MD5 SHA1 SHA512 SSDEEP

Submit Download

libstdc++-6.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\libstdc++-6.dll
Size 1.5MB
SHA256 79622396dc4c7afbbceca03e69f727bf1862735ee3ad671aa3ee7ada8aa446c3
MD5 dff338824edea7e20c7f7b2690045090
SHA1 f822aa16fb0911f663753afd6540a715231bc00a
SHA512 7bb718ef44a0184ea0108954ba8a5c771b71905acea27b900032ec3b7448bab977b0889eb5a2465f7a4e4cfa5c53140f9c9daadddeca768f220d652eb708c1b2
SSDEEP 24576:NOV/j1A8xgh30C/xM866mm3DMy3Ly5E9B0v4Q:4/zx98J3AYLy5B
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\libwinpthread-1.dll
Size 77KB
SHA256 b5fe4d6408ef2baabdd168f4c7250900606468e9aeb24c71e0c833d3d715ae65
MD5 1f4411c1f66c9cdf96ca9d7f9caf52d9
SHA1 ea04be653df7335483c7c8f46367d75d4ad9224e
SHA512 8b95d0533773c5424733862cf60ed0f0d2ed5c7016b602a71dc4ce4a90ef0946de605f46c94fb0f6c3135447f60a00d3476e8b91a61e079885aa764bc1407b8a
SSDEEP 1536:NCogndcxz8C7iYx3AUwTG36Djm2uYUjslAsvONDuJluLjIGxim3Yx:Nydcaix3v363K+GNDDLjIEim3Yx
MD5 SHA1 SHA512 SSDEEP

Submit Download

plenipotentiary.raw

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\plenipotentiary.raw
Size 4.3MB
SHA256 31df72960bd70b394b38eca8402d21a1a52de1d2afbe98115423e3c3ebb7ce11
MD5 6745fc277747e9e8f0788254472a5d5c
SHA1 484d3957615e1f69e3eed5282fb1caac4100bb0b
SHA512 593167bbb134fa83a26894dfc08a200a5bdf75485c797e58f629dcc8095b09487a249003d59089665a5f76a6e77f80eb5fec6bfb0144e3000820f3bd9c517a5a
SSDEEP 98304:EUtC1D3GjIZnNGt9hxo1FruwjKNjF8+8jnw:zYgj6NGtC1FUlFl8jnw
MD5 SHA1 SHA512 SSDEEP

Submit Download

swordcraft.swf

Path C:\Windows\Temp\{0AF9E0B7-CB48-4AC7-A72C-4EB7FEF85D7C}\.ba\swordcraft.swf
Size 51KB
SHA256 472ed476ce3a27bad8a3d068e914a386f337407e1ab52d464126df6cd33d4c5f
MD5 4b8717524d2f6a33b839bc1042ad37dd
SHA1 15a6b66824218b4e7b09fec658b5b857becc6714
SHA512 15982d6bac386c4b7e2f59ebf17cf76f4a6e6355675f6d7287684d3070b32cfb21936823eba00bd80add7fb073a6b0d9219f31bb54c974e11b53ee78da723f7c
SSDEEP 1536:Kp7RE2Xn+DcLauAvUZ65Jhi1JswxLewlHsdVO:KvE2Xb2Pvt56JxLewlHsdVO
MD5 SHA1 SHA512 SSDEEP

Submit Download

c986fd191480dd53fe2b1c6f0d689ee5.exe

Path C:\Windows\Temp\{429BD8C1-34B1-4823-938F-3DB1E821E332}\.cr\c986fd191480dd53fe2b1c6f0d689ee5.exe
Size 17.4MB
SHA256 a8804ceb2a2f9dc2ca70bb6582d2a2e697a0fab7d15ed725b662eb00c518192a
MD5 01d00349c150f0737a1683511e771a41
SHA1 88adee8767ccc335be6f73b7135bcc165863ca76
SHA512 ae992993673ef73e0bbdf069e08336da39038289d04491e9ffb32a6188e7471f3aa0363409e86b5cd58cb2710246998293bee32112e8a0223d9f9d14102f4d21
SSDEEP 393216:sp789W6XI+4TufDp8p7sHuJgyOei1pOU55jQEjC7sQASv4hJjheP+U:s5gWKv9SAEgyM7OMyEjC7/v4Dq5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1892-127-0x00007FF7FA550000-0x00007FF7FA858000-memory.dmp

Download

memory/1892-126-0x00007FF7FA550000-0x00007FF7FA858000-memory.dmp

Download

memory/1892-210-0x00007FF7FA550000-0x00007FF7FA858000-memory.dmp

Download

memory/1892-135-0x00007FF7FA550000-0x00007FF7FA858000-memory.dmp

Download

memory/1892-134-0x00007FF7FA550000-0x00007FF7FA858000-memory.dmp

Download

memory/1892-130-0x00007FF7FA550000-0x00007FF7FA858000-memory.dmp

Download

memory/2196-70-0x000000006EB40000-0x000000006EB64000-memory.dmp

Download

memory/2196-50-0x0000000073860000-0x00000000739DB000-memory.dmp

Download

memory/2196-45-0x00000000015B0000-0x0000000001BD5000-memory.dmp

Download

memory/2196-69-0x0000000066E00000-0x0000000066E3D000-memory.dmp

Download

memory/2196-49-0x0000000068A81000-0x0000000068DBF000-memory.dmp

Download

memory/2196-43-0x0000000011000000-0x000000001104D000-memory.dmp

Download

memory/2196-42-0x0000000010300000-0x000000001030B000-memory.dmp

Download

memory/2196-71-0x0000000068A80000-0x000000006906F000-memory.dmp

Download

memory/2196-51-0x00007FF9A0370000-0x00007FF9A0565000-memory.dmp

Download

memory/2196-79-0x00000000015B0000-0x0000000001BD5000-memory.dmp

Download

memory/2196-74-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Download

memory/2196-75-0x0000000061FC0000-0x00000000625B7000-memory.dmp

Download

memory/2196-77-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Download

memory/2196-78-0x0000000011000000-0x000000001104D000-memory.dmp

Download

memory/2196-68-0x0000000000400000-0x0000000000A38000-memory.dmp

Download

memory/4720-103-0x0000000073860000-0x00000000739DB000-memory.dmp

Download

memory/4720-106-0x0000000068A80000-0x000000006906F000-memory.dmp

Download

memory/4720-97-0x00000000013C0000-0x00000000019B7000-memory.dmp

Download

memory/4720-102-0x00007FF9A0370000-0x00007FF9A0565000-memory.dmp

Download

memory/4720-101-0x0000000073860000-0x00000000739DB000-memory.dmp

Download

memory/4720-108-0x000000006EB40000-0x000000006EB64000-memory.dmp

Download

memory/4720-114-0x00000000013C0000-0x00000000019B7000-memory.dmp

Download

memory/4720-105-0x0000000000400000-0x0000000000A38000-memory.dmp

Download

memory/4720-107-0x0000000061B40000-0x0000000062165000-memory.dmp

Download

memory/4720-109-0x000000006FE40000-0x000000006FFBE000-memory.dmp

Download

memory/4720-113-0x0000000064B40000-0x0000000064B5B000-memory.dmp

Download

memory/4992-119-0x0000000073860000-0x00000000739DB000-memory.dmp

Download

memory/4992-116-0x00007FF9A0370000-0x00007FF9A0565000-memory.dmp

Download