Overview

overview

10

Static

static

3

VirusShare...7b.exe

windows10-2004-x64

10

VirusShare...7b.exe

windows11-21h2-x64

10

Resubmissions

16/04/2025, 14:21

250416-rpa9kawnt9 10

Analysis

  • max time kernel
    231s
  • max time network
    233s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250410-en
  • resource tags

    arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/04/2025, 14:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe

  • Size

    64KB

  • MD5

    4aa5734fe9c86184f931f4ddaf2d4d7b

  • SHA1

    a066ccad76f3c63d053cd68ac8692d4f4acf82ac

  • SHA256

    2e18ad3e470b97415beb2cdb8e3ef7510bad21f0a5add020a7f9343dd959eeaa

  • SHA512

    7355ffd3fc59af49af1d57f5327c7442a12c8e5ddc6ec9e176cc27fd4986cd6182f5f6ce91f892c07029efcac37f90d4dd077b6bb226b54c40621b94987a044c

  • SSDEEP

    384:rdP9JIA7uJ1wK2xBpHbVbl+NGYD90pSCfZziEKffhaekBfdReVwoGHdRsArr2rOR:R9JIqNl/SSrrpBfiIdRsorZucnjtsq

Score
10/10
guloaderdiscoverydownloaderpersistence

Malware Config

Extracted

Family

guloader

C2

https://eficadgdl.com/well/Omitted-Credentials_encrypted_6A17930.bin

xor.base64

Signatures

  • Guloader family
    guloader
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Executes dropped EXE 16 IoCs
  • Adds Run key to start application 2 TTPs 17 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs
  • Suspicious use of SetThreadContext 17 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 27 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Users\Admin\AppData\Local\Temp\VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:5976
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:572
    • C:\Users\Admin\TROFFE\erythroph.exe
      C:\Users\Admin\TROFFE\erythroph.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
        C:\Users\Admin\TROFFE\erythroph.exe
        3⤵
          PID:2504
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          C:\Users\Admin\TROFFE\erythroph.exe
          3⤵
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          PID:2216
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:6088
      • C:\Users\Admin\TROFFE\erythroph.exe
        C:\Users\Admin\TROFFE\erythroph.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
          C:\Users\Admin\TROFFE\erythroph.exe
          3⤵
            PID:5012
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
            C:\Users\Admin\TROFFE\erythroph.exe
            3⤵
              PID:4388
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
              C:\Users\Admin\TROFFE\erythroph.exe
              3⤵
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:4432
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2300
          • C:\Users\Admin\TROFFE\erythroph.exe
            C:\Users\Admin\TROFFE\erythroph.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4936
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
              C:\Users\Admin\TROFFE\erythroph.exe
              3⤵
                PID:4688
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                C:\Users\Admin\TROFFE\erythroph.exe
                3⤵
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:1104
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:3492
            • C:\Users\Admin\TROFFE\erythroph.exe
              C:\Users\Admin\TROFFE\erythroph.exe
              2⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2408
              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                C:\Users\Admin\TROFFE\erythroph.exe
                3⤵
                  PID:4952
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                  C:\Users\Admin\TROFFE\erythroph.exe
                  3⤵
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:556
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:4964
              • C:\Users\Admin\TROFFE\erythroph.exe
                C:\Users\Admin\TROFFE\erythroph.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3268
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                  C:\Users\Admin\TROFFE\erythroph.exe
                  3⤵
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:6092
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:5960
              • C:\Users\Admin\TROFFE\erythroph.exe
                C:\Users\Admin\TROFFE\erythroph.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1312
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                  C:\Users\Admin\TROFFE\erythroph.exe
                  3⤵
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:1052
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:5404
              • C:\Users\Admin\TROFFE\erythroph.exe
                C:\Users\Admin\TROFFE\erythroph.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                PID:5888
                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                  C:\Users\Admin\TROFFE\erythroph.exe
                  3⤵
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:2844
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
              1⤵
                PID:3332
                • C:\Users\Admin\TROFFE\erythroph.exe
                  C:\Users\Admin\TROFFE\erythroph.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetWindowsHookEx
                  PID:112
                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                    C:\Users\Admin\TROFFE\erythroph.exe
                    3⤵
                      PID:5252
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                      C:\Users\Admin\TROFFE\erythroph.exe
                      3⤵
                        PID:6132
                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                        C:\Users\Admin\TROFFE\erythroph.exe
                        3⤵
                        • Adds Run key to start application
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        PID:5944
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
                    1⤵
                      PID:1864
                      • C:\Users\Admin\TROFFE\erythroph.exe
                        C:\Users\Admin\TROFFE\erythroph.exe
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetWindowsHookEx
                        PID:1136
                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                          C:\Users\Admin\TROFFE\erythroph.exe
                          3⤵
                          • Adds Run key to start application
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          PID:1824
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
                      1⤵
                        PID:1016
                        • C:\Users\Admin\TROFFE\erythroph.exe
                          C:\Users\Admin\TROFFE\erythroph.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetWindowsHookEx
                          PID:2080
                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                            C:\Users\Admin\TROFFE\erythroph.exe
                            3⤵
                            • Adds Run key to start application
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            PID:1556
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
                        1⤵
                          PID:1012
                          • C:\Users\Admin\TROFFE\erythroph.exe
                            C:\Users\Admin\TROFFE\erythroph.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetWindowsHookEx
                            PID:4948
                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                              C:\Users\Admin\TROFFE\erythroph.exe
                              3⤵
                              • Adds Run key to start application
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              PID:4200
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
                          1⤵
                            PID:1856
                            • C:\Users\Admin\TROFFE\erythroph.exe
                              C:\Users\Admin\TROFFE\erythroph.exe
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetWindowsHookEx
                              PID:1644
                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                C:\Users\Admin\TROFFE\erythroph.exe
                                3⤵
                                  PID:2876
                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                  C:\Users\Admin\TROFFE\erythroph.exe
                                  3⤵
                                  • Adds Run key to start application
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  PID:2028
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
                              1⤵
                                PID:3484
                                • C:\Users\Admin\TROFFE\erythroph.exe
                                  C:\Users\Admin\TROFFE\erythroph.exe
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1772
                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                    C:\Users\Admin\TROFFE\erythroph.exe
                                    3⤵
                                    • Adds Run key to start application
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • System Location Discovery: System Language Discovery
                                    PID:5176
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
                                1⤵
                                  PID:2880
                                  • C:\Users\Admin\TROFFE\erythroph.exe
                                    C:\Users\Admin\TROFFE\erythroph.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2388
                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                      C:\Users\Admin\TROFFE\erythroph.exe
                                      3⤵
                                        PID:3136
                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                        C:\Users\Admin\TROFFE\erythroph.exe
                                        3⤵
                                          PID:5300
                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                          C:\Users\Admin\TROFFE\erythroph.exe
                                          3⤵
                                          • Adds Run key to start application
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          PID:3088
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
                                      1⤵
                                        PID:4264
                                        • C:\Users\Admin\TROFFE\erythroph.exe
                                          C:\Users\Admin\TROFFE\erythroph.exe
                                          2⤵
                                          • Executes dropped EXE
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious use of SetThreadContext
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of SetWindowsHookEx
                                          PID:924
                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                            C:\Users\Admin\TROFFE\erythroph.exe
                                            3⤵
                                            • Adds Run key to start application
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • System Location Discovery: System Language Discovery
                                            PID:1816
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\TROFFE\erythroph.exe
                                        1⤵
                                          PID:1732
                                          • C:\Users\Admin\TROFFE\erythroph.exe
                                            C:\Users\Admin\TROFFE\erythroph.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5972
                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
                                              C:\Users\Admin\TROFFE\erythroph.exe
                                              3⤵
                                              • Adds Run key to start application
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • System Location Discovery: System Language Discovery
                                              PID:5352
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 1092
                                                4⤵
                                                • Program crash
                                                PID:4232
                                        • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                          "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\TestGet.docx" /o ""
                                          1⤵
                                          • Checks processor information in registry
                                          • Enumerates system info in registry
                                          • Suspicious behavior: AddClipboardFormatListener
                                          • Suspicious use of SetWindowsHookEx
                                          PID:5836
                                        • C:\Windows\system32\BackgroundTransferHost.exe
                                          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                          1⤵
                                          • Modifies registry class
                                          PID:2948
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                          1⤵
                                          • Drops file in Windows directory
                                          • Enumerates system info in registry
                                          • Modifies data under HKEY_USERS
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:3988
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc9c1dcf8,0x7ffcc9c1dd04,0x7ffcc9c1dd10
                                            2⤵
                                              PID:5236
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1904,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=1900 /prefetch:2
                                              2⤵
                                                PID:4608
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1480,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=2244 /prefetch:11
                                                2⤵
                                                  PID:2736
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2356,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=2372 /prefetch:13
                                                  2⤵
                                                    PID:3580
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3220,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3320 /prefetch:1
                                                    2⤵
                                                      PID:2192
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3288,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3472 /prefetch:1
                                                      2⤵
                                                        PID:3216
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4196,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=4220 /prefetch:9
                                                        2⤵
                                                          PID:3288
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4692,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=4724 /prefetch:1
                                                          2⤵
                                                            PID:5888
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5300,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5324 /prefetch:14
                                                            2⤵
                                                              PID:2080
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5396,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5408 /prefetch:14
                                                              2⤵
                                                                PID:4284
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5468,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=5640 /prefetch:1
                                                                2⤵
                                                                  PID:2332
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=212,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3276 /prefetch:14
                                                                  2⤵
                                                                    PID:5904
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3080,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3608 /prefetch:14
                                                                    2⤵
                                                                      PID:3344
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3272,i,9660622547756604030,11828065322054811154,262144 --variations-seed-version=20250409-205551.032000 --mojo-platform-channel-handle=3804 /prefetch:14
                                                                      2⤵
                                                                        PID:5956
                                                                    • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                      1⤵
                                                                        PID:8
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                        1⤵
                                                                          PID:1644

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4c73a8fd-939e-4ec3-bb38-7f2b3a281f5b.tmp
                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          6d04b737dfd729ae8afa22dd672c5628

                                                                          SHA1

                                                                          f3be4a667d413a387adfcb6996c6107337e7c324

                                                                          SHA256

                                                                          67956edf53b5fcfcc7f017eac36b79726e25ca5f36bc97fea396d1e7bcad8918

                                                                          SHA512

                                                                          d5371c4751aba9aa1905d69308b14f1d1f40abfee5d52b4f67466fc1685fbdf0103109c0a2f33242ac34e0725b7efd346706b043d67d7c6dd0187403ad917845

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                          Filesize

                                                                          414B

                                                                          MD5

                                                                          68040e8620b8ecd3f780bc667aa8471b

                                                                          SHA1

                                                                          3c6d3a422f7eda7560ec8701e7061996ae577e0f

                                                                          SHA256

                                                                          d0f538a36bc8bed577922f47723e4b3ff95d1d5baaf3226d0e889b6d2af0023a

                                                                          SHA512

                                                                          4838e490ddb324633265260481ae761a8d7755c93dee40c3400c78a712a5330c8819074366075beb0137dd9b20acb22a74270489e0b5608898152f797e3813e8

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                          Filesize

                                                                          2KB

                                                                          MD5

                                                                          3e60ea92b944845a1891f1a23cafcc8d

                                                                          SHA1

                                                                          7d7226393942130f6775eb42c449cf95be11af94

                                                                          SHA256

                                                                          ab211943771bffe9a5fc75305daebb4a66bbd3296a0d159cd25a44696c0d9db1

                                                                          SHA512

                                                                          35972c6cacfa22decc738038e6f597f4e3d94a63abbcc4384a83dda3d4792ac8b67f395b437db66f97717dd7a2fef6a6245d9f433462761d4f34af5680fe6085

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                          Filesize

                                                                          2B

                                                                          MD5

                                                                          d751713988987e9331980363e24189ce

                                                                          SHA1

                                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                                          SHA256

                                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                          SHA512

                                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                          Filesize

                                                                          10KB

                                                                          MD5

                                                                          e4ed0a866f70722eef4d9e8641e817d8

                                                                          SHA1

                                                                          a95c4a81c7190805386306fa69629e5b785cf509

                                                                          SHA256

                                                                          a97e9a85ae36ef18391722ad8cad003baac09e58f3e1f105dccae53fa4898049

                                                                          SHA512

                                                                          97fc00b7a653c1e920bbad5e56711dc1912bc3dd7fa9f5e56964e169482f802df36e2ceede5219a863556b127463941b7b0a081b7218e4e44b0ae1c55a4f4d4f

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                          Filesize

                                                                          15KB

                                                                          MD5

                                                                          1f392154188ee1180199aaf97e3bbf8c

                                                                          SHA1

                                                                          cffa5711362f8e60070608013d157bbadcc5a99d

                                                                          SHA256

                                                                          b985301d135bb87de684c06043a5959e7e33e77197fafe0984d9d0ce4e1f86bd

                                                                          SHA512

                                                                          a798cf8030b206e689ccc95ebecdce7dcf7c66a4af4bba19c177926f43efb61b52b67cb22ed55c8265d0fea2a77b13ecd28c6f181abd94722a61648f50e62865

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                          Filesize

                                                                          72B

                                                                          MD5

                                                                          6d41f92fdf7bcc42f306f9ad89f28927

                                                                          SHA1

                                                                          971ff68abfc0ae3dbadbdb35b7a23dac0c990a4c

                                                                          SHA256

                                                                          f7bdbc4f6f467315482a3bf1ccf5751ffcb00c8ffd3af6a086b683dd0bf88b3f

                                                                          SHA512

                                                                          d40ef5129d2390f7c5f9ed3623de8eeb4114b1e8321cb77fe1a077b7d2526e41f6d4f17de11bffb2dd91c7090c430abe41494445c0a6d988c289957d2ead0ac5

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe599929.TMP
                                                                          Filesize

                                                                          48B

                                                                          MD5

                                                                          159f011733ec4fbf169fd0614108a5f6

                                                                          SHA1

                                                                          efa84ea262c53103bb647d5f9db9951d1d2f1b10

                                                                          SHA256

                                                                          ba0161292b4b26ec641ccce21f802668ca8200e18a24dbd4a9d1456905f18c77

                                                                          SHA512

                                                                          93f1666db8d4cbb6258ca94ced1492312006b7274f881dc56efeaed701c6ff3475733cbd76551de265f24800da2dae7533d83df3e042d3d991cc0964252d603b

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          Filesize

                                                                          152KB

                                                                          MD5

                                                                          da1a236a3c2368a68652d79b441868af

                                                                          SHA1

                                                                          e2da91a008d606f068531df365762198b3bda412

                                                                          SHA256

                                                                          caa6f71c05ec956c86d284affe2628e85117ebfcd5df4636f5b647f5ad87c122

                                                                          SHA512

                                                                          1f0439fb62c732315174770dd373a023d9a590a5a5364c0242b49d2b75d25143f763fd1a689d740d2ca7ca74a786e43ac9996e9eef0339122d0cb228660ec2fe

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          Filesize

                                                                          78KB

                                                                          MD5

                                                                          8a6be326dcffb617519d73869d8f9ccd

                                                                          SHA1

                                                                          0cf1d47ea1d8c59f8787a42cc9407929050d476b

                                                                          SHA256

                                                                          4adb3dff6b691b1de563e7326adf077aca0a3f8eb523dc11e7054dd778361fe2

                                                                          SHA512

                                                                          c1b2d2cb6a680c651179b4ac9476da4d2a0df193a3a8c3bc4d7fe2d4e76cd49eca9decc2a98469631d0be512a083cb6f423d7fac9360a0ce1b5756a03e3f948c

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                          Filesize

                                                                          151KB

                                                                          MD5

                                                                          271156b48bddafd93d5bf4ccca0acdf3

                                                                          SHA1

                                                                          a62351a7a9a157c08eee920b27113ee0f1765c08

                                                                          SHA256

                                                                          7ca67281593182b3c92a281635d620ae415d048801797535ab9b0bd9dab8f5d1

                                                                          SHA512

                                                                          682533ed3cf944ec6b0ff781b5adc6cb3f9f0a25a2473db0665ad8387199f644b99011a0dbf2ec26a247220f87fc3a0749682a1ae52fd08ac47561e6e85cae5b

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\13e19984-169d-463a-a296-e55ad89fd625.down_data
                                                                          Filesize

                                                                          555KB

                                                                          MD5

                                                                          5683c0028832cae4ef93ca39c8ac5029

                                                                          SHA1

                                                                          248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                                                                          SHA256

                                                                          855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                                                                          SHA512

                                                                          aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
                                                                          Filesize

                                                                          258B

                                                                          MD5

                                                                          0fce563db74c47ed74567b071649b51a

                                                                          SHA1

                                                                          701f39abaff131f204cbd162dbac61e3ed7eaed7

                                                                          SHA256

                                                                          694403e2972d40ffe93192ad6d7948e7e40e642fad8bf4400c56638a0cf8e9f3

                                                                          SHA512

                                                                          06ae6076346984592486e53d0d685199d5b927734b7fc60061c6b4359b688710a59abc41bf4e483756ff840c38aac9830384db5d6e5a3000056d54fe615abb8f

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
                                                                          Filesize

                                                                          16B

                                                                          MD5

                                                                          d29962abc88624befc0135579ae485ec

                                                                          SHA1

                                                                          e40a6458296ec6a2427bcb280572d023a9862b31

                                                                          SHA256

                                                                          a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

                                                                          SHA512

                                                                          4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
                                                                          Filesize

                                                                          2B

                                                                          MD5

                                                                          f3b25701fe362ec84616a93a45ce9998

                                                                          SHA1

                                                                          d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                          SHA256

                                                                          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                          SHA512

                                                                          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                          Download Submit

                                                                        • C:\Users\Admin\TROFFE\erythroph.exe
                                                                          Filesize

                                                                          64KB

                                                                          MD5

                                                                          4aa5734fe9c86184f931f4ddaf2d4d7b

                                                                          SHA1

                                                                          a066ccad76f3c63d053cd68ac8692d4f4acf82ac

                                                                          SHA256

                                                                          2e18ad3e470b97415beb2cdb8e3ef7510bad21f0a5add020a7f9343dd959eeaa

                                                                          SHA512

                                                                          7355ffd3fc59af49af1d57f5327c7442a12c8e5ddc6ec9e176cc27fd4986cd6182f5f6ce91f892c07029efcac37f90d4dd077b6bb226b54c40621b94987a044c

                                                                          Download Submit

                                                                        • memory/1556-67-0x00000000750E0000-0x000000007536A000-memory.dmp

                                                                          Filesize

                                                                          2.5MB

                                                                          Download

                                                                        • memory/1824-66-0x00000000750E0000-0x000000007536A000-memory.dmp

                                                                          Filesize

                                                                          2.5MB

                                                                          Download

                                                                        • memory/2192-71-0x0000000002310000-0x0000000002318000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/2192-2-0x0000000002310000-0x0000000002318000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/2192-25-0x0000000002310000-0x0000000002318000-memory.dmp

                                                                          Filesize

                                                                          32KB

                                                                          Download

                                                                        • memory/2192-4-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

                                                                          Filesize

                                                                          2.0MB

                                                                          Download

                                                                        • memory/2192-3-0x00007FFCD8EE1000-0x00007FFCD900A000-memory.dmp

                                                                          Filesize

                                                                          1.2MB

                                                                          Download

                                                                        • memory/2216-52-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

                                                                          Filesize

                                                                          2.0MB

                                                                          Download

                                                                        • memory/2216-15-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

                                                                          Filesize

                                                                          2.0MB

                                                                          Download

                                                                        • memory/2216-69-0x00000000750E0000-0x000000007536A000-memory.dmp

                                                                          Filesize

                                                                          2.5MB

                                                                          Download

                                                                        • memory/2724-14-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

                                                                          Filesize

                                                                          2.0MB

                                                                          Download

                                                                        • memory/2844-64-0x00000000750E0000-0x000000007536A000-memory.dmp

                                                                          Filesize

                                                                          2.5MB

                                                                          Download

                                                                        • memory/4432-70-0x00000000750E0000-0x000000007536A000-memory.dmp

                                                                          Filesize

                                                                          2.5MB

                                                                          Download

                                                                        • memory/5836-72-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-123-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-125-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-73-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-74-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-78-0x00007FFC96990000-0x00007FFC969A0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-124-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-126-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-77-0x00007FFC96990000-0x00007FFC969A0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-75-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5836-76-0x00007FFC98F70000-0x00007FFC98F80000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                          Download

                                                                        • memory/5976-35-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

                                                                          Filesize

                                                                          2.0MB

                                                                          Download

                                                                        • memory/5976-68-0x00000000750E0000-0x000000007536A000-memory.dmp

                                                                          Filesize

                                                                          2.5MB

                                                                          Download

                                                                        • memory/5976-8-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

                                                                          Filesize

                                                                          2.0MB

                                                                          Download

                                                                        • memory/5976-6-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

                                                                          Filesize

                                                                          2.0MB

                                                                          Download

                                                                        • memory/5976-5-0x00007FFCD8EE0000-0x00007FFCD90E9000-memory.dmp

                                                                          Filesize

                                                                          2.0MB

                                                                          Download