dc069d170ae0819238da9f2382001df44b2240620201e216fdcf43b0bb4b22aa

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
10/12/2025, 07:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc069d170ae0819238da9f2382001df44b2240620201e216fdcf43b0bb4b22aa.jar
Size 32KB
Sample251210-htf6yawkcw
SHA256 dc069d170ae0819238da9f2382001df44b2240620201e216fdcf43b0bb4b22aa
MD5 081f1a973599623951585c4bd1f1679b
SHA1 804eaae5795711a125908a72966acbe340aca383
SHA512 2bc19e4eb5219b18bfcaf2238f7d680b8ca3a9ded2dd3f317e56227235bfdafe4a4943c3f2a3b115b1113aef89a8b96c8e7d75d5f0698603d9da03a091f363c1
SSDEEP 768:HtBG3XN2hR/RSCjkCnkRcU5135uEmoC/P/g/ri4y+lX9S:Ht43XN2TZHjvnkR75135uEmo8PoVo
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

credential_access defense_evasion discovery execution persistence stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5860	powershell.exe

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5356	chrome.exe
1528	chrome.exe
3768	chrome.exe
4040	chrome.exe
4796	msedge.exe
424	msedge.exe
5964	msedge.exe
4168	chrome.exe

Loads dropped DLL 5 IoCs

pid	Process
4824	java.exe
2072	java.exe
1236	chrome.exe
2072	java.exe
1512	msedge.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-503569783-3534512106-765729973-1000\Software\Microsoft\Windows\CurrentVersion\Run\javacom = "C:\\Users\\Admin\\AppData\\Roaming\\AutoStartMini\\javacom-run.bat"	reg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
2700	taskkill.exe
5128	taskkill.exe
3280	taskkill.exe
8	taskkill.exe
4048	TASKKILL.exe
1264	TASKKILL.exe
3360	taskkill.exe
3156	taskkill.exe
3332	taskkill.exe
6036	taskkill.exe
4776	TASKKILL.exe
652	taskkill.exe
4252	taskkill.exe
2452	TASKKILL.exe
2536	taskkill.exe
3684	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5860	powershell.exe
5860	powershell.exe
4168	chrome.exe
4168	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4796	msedge.exe
4796	msedge.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe
4168	chrome.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3332	taskkill.exe
Token: SeDebugPrivilege	652	taskkill.exe
Token: SeDebugPrivilege	8	taskkill.exe
Token: SeDebugPrivilege	6036	taskkill.exe
Token: SeDebugPrivilege	3684	taskkill.exe
Token: SeDebugPrivilege	4252	taskkill.exe
Token: SeDebugPrivilege	5860	powershell.exe
Token: SeDebugPrivilege	4048	TASKKILL.exe
Token: SeDebugPrivilege	2452	TASKKILL.exe
Token: SeDebugPrivilege	1264	TASKKILL.exe
Token: SeDebugPrivilege	4776	TASKKILL.exe
Token: SeDebugPrivilege	2536	taskkill.exe
Token: SeDebugPrivilege	3360	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	3280	taskkill.exe
Token: SeDebugPrivilege	5128	taskkill.exe
Token: SeDebugPrivilege	3156	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4796	msedge.exe
4168	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2072	java.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4824	4700	java.exe	79
PID 4700 wrote to memory of 2072	4700	java.exe	81
PID 2072 wrote to memory of 4084	2072	java.exe	83
PID 2072 wrote to memory of 2108	2072	java.exe	85
PID 2108 wrote to memory of 3332	2108	cmd.exe	87
PID 2072 wrote to memory of 2944	2072	java.exe	89
PID 2944 wrote to memory of 652	2944	cmd.exe	91
PID 2072 wrote to memory of 3384	2072	java.exe	92
PID 3384 wrote to memory of 8	3384	cmd.exe	94
PID 2072 wrote to memory of 1796	2072	java.exe	95
PID 2072 wrote to memory of 4744	2072	java.exe	97
PID 1796 wrote to memory of 6036	1796	cmd.exe	99
PID 4744 wrote to memory of 2184	4744	cmd.exe	100
PID 2072 wrote to memory of 5692	2072	java.exe	101
PID 2072 wrote to memory of 4888	2072	java.exe	102
PID 4888 wrote to memory of 3684	4888	cmd.exe	104
PID 2072 wrote to memory of 4036	2072	java.exe	105
PID 4036 wrote to memory of 4252	4036	cmd.exe	107
PID 5692 wrote to memory of 5860	5692	javaw.exe	108
PID 2072 wrote to memory of 1236	2072	java.exe	111
PID 2072 wrote to memory of 1512	2072	java.exe	114
PID 5860 wrote to memory of 6112	5860	powershell.exe	116
PID 2072 wrote to memory of 4048	2072	java.exe	118
PID 2072 wrote to memory of 4796	2072	java.exe	120
PID 4796 wrote to memory of 400	4796	msedge.exe	121
PID 4796 wrote to memory of 5776	4796	msedge.exe	122
PID 4796 wrote to memory of 3232	4796	msedge.exe	123
PID 4796 wrote to memory of 3232	4796	msedge.exe	123
PID 4796 wrote to memory of 3232	4796	msedge.exe	123
PID 4796 wrote to memory of 1176	4796	msedge.exe	124
PID 4796 wrote to memory of 1176	4796	msedge.exe	124
PID 4796 wrote to memory of 5964	4796	msedge.exe	126
PID 4796 wrote to memory of 5964	4796	msedge.exe	126
PID 4796 wrote to memory of 5964	4796	msedge.exe	126
PID 4796 wrote to memory of 424	4796	msedge.exe	127
PID 4796 wrote to memory of 424	4796	msedge.exe	127
PID 4796 wrote to memory of 424	4796	msedge.exe	127
PID 2072 wrote to memory of 2452	2072	java.exe	129
PID 2072 wrote to memory of 1264	2072	java.exe	131
PID 2072 wrote to memory of 4168	2072	java.exe	133
PID 4168 wrote to memory of 2612	4168	chrome.exe	134
PID 4168 wrote to memory of 5808	4168	chrome.exe	135
PID 4168 wrote to memory of 5900	4168	chrome.exe	136
PID 4168 wrote to memory of 5808	4168	chrome.exe	135
PID 4168 wrote to memory of 888	4168	chrome.exe	137
PID 4168 wrote to memory of 888	4168	chrome.exe	137
PID 4168 wrote to memory of 1528	4168	chrome.exe	139
PID 4168 wrote to memory of 5356	4168	chrome.exe	140
PID 4168 wrote to memory of 1528	4168	chrome.exe	139
PID 4168 wrote to memory of 5356	4168	chrome.exe	140
PID 4168 wrote to memory of 3768	4168	chrome.exe	141
PID 4168 wrote to memory of 3768	4168	chrome.exe	141
PID 4168 wrote to memory of 4040	4168	chrome.exe	142
PID 4168 wrote to memory of 4040	4168	chrome.exe	142
PID 2072 wrote to memory of 4776	2072	java.exe	143
PID 2072 wrote to memory of 2240	2072	java.exe	145
PID 2240 wrote to memory of 2536	2240	cmd.exe	147
PID 2072 wrote to memory of 3528	2072	java.exe	148
PID 3528 wrote to memory of 3360	3528	cmd.exe	150
PID 2072 wrote to memory of 5720	2072	java.exe	151
PID 5720 wrote to memory of 2700	5720	cmd.exe	153
PID 2072 wrote to memory of 4340	2072	java.exe	154
PID 4340 wrote to memory of 3280	4340	cmd.exe	156
PID 2072 wrote to memory of 336	2072	java.exe	157

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\dc069d170ae0819238da9f2382001df44b2240620201e216fdcf43b0bb4b22aa.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar C:\Users\Admin\AppData\Local\Temp\discord3821347566235200331.jar
  2⤵
  - Loads dropped DLL
  PID:4824
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar C:\Users\Admin\AppData\Local\Temp\downloaded1399230252712778034.jar 344873527326801920======================================================================================== Click Click Click 6662
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SYSTEM32\reg.exe
    reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
    3⤵
    PID:4084
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM chrome.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM chrome.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM browser.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM browser.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:652
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM brave.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM brave.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:8
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM msedge.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM msedge.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javacom" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AutoStartMini\javacom-run.bat" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javacom" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AutoStartMini\javacom-run.bat" /f
      4⤵
      Adds Run key to start application
      PID:2184
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar C:\Users\Admin\AppData\Roaming\JavaInstaller\JavaInt.jar 344873527326801920
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Start-Process -WindowStyle Hidden -WorkingDirectory 'C:\Users\Admin\AppData\Roaming\JavaInstaller' -FilePath 'C:\Program Files\Java\jre-1.8\bin\java.exe' -ArgumentList '-jar','C:\Users\Admin\AppData\Roaming\JavaInstaller\Site.jar', '344873527326801920'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5860
    - - C:\Program Files\Java\jre-1.8\bin\java.exe
        
        "C:\Program Files\Java\jre-1.8\bin\java.exe" -jar C:\Users\Admin\AppData\Roaming\JavaInstaller\Site.jar 344873527326801920
        5⤵
        
        PID:6112
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM opera.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM opera.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3684
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM vivaldi.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM vivaldi.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Loads dropped DLL
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Loads dropped DLL
    PID:1512
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ff950c4f208,0x7ff950c4f214,0x7ff950c4f220
      4⤵
      PID:400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2172,i,9697911164644453191,2224959616906094220,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2132,i,9697911164644453191,2224959616906094220,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:2
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=2488,i,9697911164644453191,2224959616906094220,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:13
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3968,i,9697911164644453191,2224959616906094220,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3996,i,9697911164644453191,2224959616906094220,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:424
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=9222 --headless --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9625edcf8,0x7ff9625edd04,0x7ff9625edd10
      4⤵
      PID:2612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2024,i,5535833399921173469,816335941544818350,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2012 /prefetch:2
      4⤵
      PID:5808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2120,i,5535833399921173469,816335941544818350,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2116 /prefetch:11
      4⤵
      PID:5900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2404,i,5535833399921173469,816335941544818350,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=2392 /prefetch:13
      4⤵
      PID:888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3612,i,5535833399921173469,816335941544818350,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3636,i,5535833399921173469,816335941544818350,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4232,i,5535833399921173469,816335941544818350,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4228 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4588,i,5535833399921173469,816335941544818350,262144 --disable-features=PaintHolding --variations-seed-version=20251015-090059.375000 --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4040
- - C:\Windows\SYSTEM32\TASKKILL.exe
    TASKKILL /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4776
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM chrome.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM chrome.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM browser.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM browser.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3360
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM brave.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5720
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM brave.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2700
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM msedge.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM msedge.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM opera.exe /F"
    3⤵
    PID:336
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM opera.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5128
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c "taskkill /IM vivaldi.exe /F"
    3⤵
    PID:2644
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM vivaldi.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3156

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1732

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\JavaInstaller\JavaInt.jar" 344873527326801920
1⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1052

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 11e1ef222994115c5681f2eff450e4f692491aedce81ccbba2f3b5b1ff7a8c01
MD5 96f5e1199f767da02d7acc9f46d4ad81
SHA1 50528b4764cd96ec6adf3c8b6145f1c012f76a14
SHA512 c85b1a0159c103e9a4d3cbdad9a58d8b744658c3d379879a96e2ccdd7f5facf1484dbd913ea7589d401fdd91f42d03e6b7383bbe69016e59a8b46f2b31d46a5f
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 9666044caf3f597818b5024b4c3e1ed2fa71f7982a887f25ce7a4d5a8ee43a9b
MD5 4d17c3e5f070d8c5472a185a14e2ceca
SHA1 cc90c3d71e4421ea4a111df35dc5292fa1b6e63b
SHA512 b79d235a28846763552d3530193e1b713626afd83fd6670ea7ca4c559f12829de64e2def16aa5f12950e03eafa16fc3f4b6c20d863bf7a97416e6ad4f2caefa5
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 f5a02231632dc6080485943d49c3c6d12b90498ae82fb02c142b07808282646f
MD5 e7e5dd4055b1101b22445d8b68e945b6
SHA1 9bbcd0037b2ca8ee438d15652ac0fc610173942a
SHA512 e080bc4230992d1df722b546de79d92c24ee1a232ec47a7ba1152facfbe5333a10e4d7064359722a1cd2da9d5d3568094c1f4040228141fd31a13c7c3e751451
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 a2ea04e57db9fad5eff673069928ceeece53d96b8eeaab7a8c05d99ddc2d0145
MD5 adb36c7f8490c0d99f0f730346198279
SHA1 8a5a24e3a9975b7daec586dff1fb9cf8167b6a40
SHA512 6592e43b92462c12ef61cb4e5815deef2f35af968035c6430b71f441f091767a9eddcb21a40cf89a082d9aa7fa9c083e611b9e116abc53de4143cd840db1e096
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 117KB
SHA256 a39469ff03c425f07e3650010123f560e5c08d01b4375326efcdcc6165baaf0e
MD5 8e2345211189dc490df72a9825a5ce4b
SHA1 7dcaac2817adffddd3cc832d02bd75195a62c38a
SHA512 177758d05d7b0d09759620dd5b18dceefd237bc4553674c093193cc0795d0df00adc4ffd79d2f882de881c3a8b9e7775101d10efe36b7b2f27154c8417b9f9dd
SSDEEP 3072:msXGx6i79xko7HWrQvhLK1PTEsbWRtHqldg+G/cTU:pWMExki2KL64sbWRtHqldg+G/MU
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 57ca21529d6a64ba48b0a353037c52c09a0fbe63831896d75c49e541a26b0b7a
MD5 db1454c32599b4a9986f337d7c99e2f1
SHA1 0be95eea75f4748a1fa0d2198a869cb18cca8cc7
SHA512 e6172970ad5635f0b42f3f99d7a02e87952efa17333c974fff88a32d077138e1d98e35e508cf2e4077d234c543f57a254c8ef72741858ffc31c1574e243b56d6
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e6d387468a505b7543e3f12f5f3af74bb9c094f6814b409a78d48b9f40a88598
MD5 23a95379b20a6ceb250e1f1b5023790d
SHA1 36d3cb6ee6b7d4aafe11ca47f01c8040a170d087
SHA512 46e1e0319fcf13a7c15d030935562818a070da9cd31a08d1f98d294d03c93eeac0b1cdf76a4e7838373063339ed81f23a6d1adcb09fc5d0453a4a5ecbe20c6be
SSDEEP 768:yF5BLv7I5wCPFdV6Zi63UCgXzo53ao2Xw4memoX/ofoccj3:iJUV6ZL3XLkANcj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 710bf70fc6dfc04ccdf42586225f6a741b9d85beee9ea7f24db018a36c7148eb
MD5 a2d3b9f068a36ef5fa89032365634790
SHA1 c53262de40033114754fd313cdabf71474f2054c
SHA512 d82ff720f8e99b1c452908d0b44665b53d96236eda100db1a7907f759a5a7db8703b24a917423894a9a472300c928a74f10ce7ec6236fa4592b91a1a2d75b3ac
SSDEEP 768:jF5BLv7I5wCPFdV6Zi63UCgXMe63ao2XwrXqvjuR6ipoccj3:jJUV6ZL3X1Tgjq6scj3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_l01qywyh.kwt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l01qywyh.kwt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

discord3821347566235200331.jar

Path C:\Users\Admin\AppData\Local\Temp\discord3821347566235200331.jar
Size 3.3MB
SHA256 96952ba44ae8ea88bd6298e82ba33df37bb8d95a95f0b523a829a2c2de9879d9
MD5 7aa1d8a103b5c5b9fc36301270b980b9
SHA1 223c24fa3a657522debd7dc2301199a940e3a4c5
SHA512 7c7ba32471ccd3cf57f97b503632ef66085da882203f9d9bb172643d4359ed9256b401b797de5c8bc3a4a11e0c4031c1d7e5c875747542964f1fd6b88078ba23
SSDEEP 98304:oHNILeeE+l1sS3zDh/lY2CudGssoG79TtIwe7M6WJhbmd:otgg+lPjdlY2CA2oGpT+u6WLmd
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloaded1399230252712778034.jar

Path C:\Users\Admin\AppData\Local\Temp\downloaded1399230252712778034.jar
Size 21.6MB
SHA256 8c272d62c9757902fa945b95baf703f16869183d2b55ee5c6d6dc1437b4db6af
MD5 8d9eebcf9486ebdab24848b0da3daa58
SHA1 a01ff76d900d0be1c66692bbc54d516dc702de4c
SHA512 de7b19bc59b513c329ca9b0917ff4041997850348aeec6ad99729f7fd3202c5ba72dd0a2b442b9bc367380b1b6cb92bc7392028ecf8ddd87a75dcce6be7a5056
SSDEEP 393216:sEIFDVFLYdDpnkeQzQFepWA6zULoOupcspNoaAGJ3j59aUm8Wql40:kFLYdDpkdiXdqM5AG5O30
MD5 SHA1 SHA512 SSDEEP

Submit Download

jna457892734619870128.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna457892734619870128.dll
Size 229KB
SHA256 cf8e552ee05cb0e872797ecffe0f9d3dc67e513748f3cd957f79e0f2f3d66ac2
MD5 cfebe457d00a97c2c5f8930bdbaae1f0
SHA1 526e95d2afde5ef07dd0aca671261dfbc7fcfa17
SHA512 fbded4dc03011e58219f622e724c0737475ce95a1a3619ca5e68babe5b734afc664523e93f96047e20d4d82411ccace0bac42f1dc77a2da2f94886ba04fab8a0
SSDEEP 3072:gTD0CYjMP9JCy+kveYFmAst0BpwekWV/5SZw1VVOeVDslm/m6yGfx:sOM9JCxk2QsyrKWRrslm/m6yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jna818985541837473928.dll

Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna818985541837473928.dll
Size 248KB
SHA256 13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03
MD5 34d12b1e2af72d9bb267bbc8c0d53e4a
SHA1 d9ed8776645f6b4f52df16132450863c47ea92d7
SHA512 c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10
SSDEEP 6144:9RW+uZb5K8Dy+Zkt9dHlJ1ybBEleb906aslm/mFyygW:9RW+MbMOEe3Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

moddll8464744308531930736.dll

Path C:\Users\Admin\AppData\Local\Temp\moddll8464744308531930736.dll
Size 36KB
SHA256 ec1a4674c22e88038a5dc21bcf8e9b7a1718f00df711a6cd13ba3eb021017a7d
MD5 36d3d32d69d5745939583d12f5a28445
SHA1 1ed261233dbb9484a6589b420bcb7b5b588b115b
SHA512 f714511449fb405a2a0579ebdee2269b103aae1f54bed3be77bab752c851c761649bcb6457285ebeb57bf31852e0d5adfe832239e3463e0c1d53aa4a7b81ba59
SSDEEP 768:MEXRIrKClhXeN7J+MiF6wJSNluMMfzsygsx:TBGKClhBUegFMfzcsx
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite-3.45.3.0-121bdd23-68e1-409d-8363-752145487aac-sqlitejdbc.dll

Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.45.3.0-121bdd23-68e1-409d-8363-752145487aac-sqlitejdbc.dll
Size 947KB
SHA256 14dee990e031f70c879d5b1b07dc1f8e077952db51e3bb37282f37684f06e18d
MD5 fc683f23febf5492ce94521b369014a8
SHA1 8b72934bf6d8885cdcbf028867d83b1f89ad1b21
SHA512 f022f19763d5d27160826da4b93c1c5eabc0c7f61fd1f39f4bcca3a5d16f721fec6fcf5bf78ea8691a190dcece6848c33e7f51777f6b8812aadec98cdf311f56
SSDEEP 24576:5iGt+jeMSQXL9Ev84DfQXgLlzpqOHN8WaI:1ZnQb9Evj5vqOHNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

JavaInt.jar

Path C:\Users\Admin\AppData\Roaming\JavaInstaller\JavaInt.jar
Size 20KB
SHA256 74ae055e77296ab32152fe06983d63046ef31d4335ff05b109f27af3ef438cc4
MD5 2f8c264728f92c3a76a910f02033eece
SHA1 fabb8cf5b9abb7f3a920a7e69fbfc378caba7c61
SHA512 bf5f25ec9c33cc4883cdadb5e968f2e1e499d06dc6a78dfc3a47afdb6be0c51ca8e3d18e4ee3e8797887e9731450a596a117d40d91bc04dfe62c2e877889b1d1
SSDEEP 384:JHcZeoo/zxDwuKX6yGYnmAsFz6VCB9Y5DXEpZgkVMlRe8Sx4K:JaAlDwPIYnmASzWlpaJ3xn
MD5 SHA1 SHA512 SSDEEP

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_c647217f-7b73-421b-b9bb-3bd15e8b5319

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-503569783-3534512106-765729973-1000\83aa4cc77f591dfc2374580bbd95f6ba_c647217f-7b73-421b-b9bb-3bd15e8b5319
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/1016-542-0x0000013C9BD70000-0x0000013C9BD71000-memory.dmp

Download

memory/1016-574-0x0000013C9D5B0000-0x0000013C9DE60000-memory.dmp

Download

memory/2072-540-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-148-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-590-0x000001DC83CD0000-0x000001DC84580000-memory.dmp

Download

memory/2072-589-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-576-0x000001DC83CD0000-0x000001DC84580000-memory.dmp

Download

memory/2072-559-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-509-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-491-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-457-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-456-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-453-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-416-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-384-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-372-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-358-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-306-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-305-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-300-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-286-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-234-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-211-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-210-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-201-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-197-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/2072-149-0x000001DC84580000-0x000001DC84581000-memory.dmp

Download

memory/4700-607-0x0000015922190000-0x00000159221A0000-memory.dmp

Download

memory/4700-17-0x0000015922040000-0x0000015922050000-memory.dmp

Download

memory/4700-106-0x0000015921D90000-0x0000015921D91000-memory.dmp

Download

memory/4700-48-0x00000159220F0000-0x0000015922100000-memory.dmp

Download

memory/4700-592-0x00000159214E0000-0x0000015921D90000-memory.dmp

Download

memory/4700-47-0x0000015922050000-0x0000015922060000-memory.dmp

Download

memory/4700-42-0x0000015922040000-0x0000015922050000-memory.dmp

Download

memory/4700-593-0x00000159220C0000-0x00000159220D0000-memory.dmp

Download

memory/4700-594-0x0000015922020000-0x0000015922030000-memory.dmp

Download

memory/4700-119-0x0000015922130000-0x0000015922140000-memory.dmp

Download

memory/4700-595-0x0000015922030000-0x0000015922040000-memory.dmp

Download

memory/4700-596-0x0000015922040000-0x0000015922050000-memory.dmp

Download

memory/4700-597-0x0000015922050000-0x0000015922060000-memory.dmp

Download

memory/4700-598-0x0000015922060000-0x0000015922070000-memory.dmp

Download

memory/4700-599-0x0000015922070000-0x0000015922080000-memory.dmp

Download

memory/4700-43-0x00000159220E0000-0x00000159220F0000-memory.dmp

Download

memory/4700-139-0x0000015921D90000-0x0000015921D91000-memory.dmp

Download

memory/4700-37-0x0000015922030000-0x0000015922040000-memory.dmp

Download

memory/4700-147-0x0000015922140000-0x0000015922150000-memory.dmp

Download

memory/4700-95-0x0000015922120000-0x0000015922130000-memory.dmp

Download

memory/4700-600-0x0000015922080000-0x0000015922090000-memory.dmp

Download

memory/4700-167-0x0000015922150000-0x0000015922160000-memory.dmp

Download

memory/4700-51-0x0000015922060000-0x0000015922070000-memory.dmp

Download

memory/4700-200-0x0000015922160000-0x0000015922170000-memory.dmp

Download

memory/4700-88-0x0000015922100000-0x0000015922110000-memory.dmp

Download

memory/4700-89-0x0000015922190000-0x00000159221A0000-memory.dmp

Download

memory/4700-87-0x00000159220F0000-0x0000015922100000-memory.dmp

Download

memory/4700-86-0x0000015921D90000-0x0000015921D91000-memory.dmp

Download

memory/4700-237-0x0000015922170000-0x0000015922180000-memory.dmp

Download

memory/4700-38-0x00000159220D0000-0x00000159220E0000-memory.dmp

Download

memory/4700-32-0x0000015921DB0000-0x0000015922020000-memory.dmp

Download

memory/4700-33-0x00000159220B0000-0x00000159220C0000-memory.dmp

Download

memory/4700-601-0x0000015922090000-0x00000159220A0000-memory.dmp

Download

memory/4700-34-0x00000159220C0000-0x00000159220D0000-memory.dmp

Download

memory/4700-35-0x0000015922020000-0x0000015922030000-memory.dmp

Download

memory/4700-79-0x0000015921D90000-0x0000015921D91000-memory.dmp

Download

memory/4700-285-0x0000015921D90000-0x0000015921D91000-memory.dmp

Download

memory/4700-29-0x00000159220A0000-0x00000159220B0000-memory.dmp

Download

memory/4700-27-0x0000015922090000-0x00000159220A0000-memory.dmp

Download

memory/4700-77-0x0000015922180000-0x0000015922190000-memory.dmp

Download

memory/4700-76-0x00000159220E0000-0x00000159220F0000-memory.dmp

Download

memory/4700-73-0x00000159220D0000-0x00000159220E0000-memory.dmp

Download

memory/4700-319-0x0000015922180000-0x0000015922190000-memory.dmp

Download

memory/4700-602-0x00000159220B0000-0x00000159220C0000-memory.dmp

Download

memory/4700-26-0x0000015922080000-0x0000015922090000-memory.dmp

Download

memory/4700-603-0x0000015921DB0000-0x0000015922020000-memory.dmp

Download

memory/4700-604-0x00000159220D0000-0x00000159220E0000-memory.dmp

Download

memory/4700-23-0x0000015922070000-0x0000015922080000-memory.dmp

Download

memory/4700-21-0x0000015922060000-0x0000015922070000-memory.dmp

Download

memory/4700-19-0x0000015922050000-0x0000015922060000-memory.dmp

Download

memory/4700-74-0x0000015922170000-0x0000015922180000-memory.dmp

Download

memory/4700-605-0x00000159220E0000-0x00000159220F0000-memory.dmp

Download

memory/4700-362-0x00000159214E0000-0x0000015921D90000-memory.dmp

Download

memory/4700-70-0x0000015922160000-0x0000015922170000-memory.dmp

Download

memory/4700-69-0x00000159220C0000-0x00000159220D0000-memory.dmp

Download

memory/4700-94-0x0000015922110000-0x0000015922120000-memory.dmp

Download

memory/4700-606-0x00000159220F0000-0x0000015922100000-memory.dmp

Download

memory/4700-66-0x00000159220B0000-0x00000159220C0000-memory.dmp

Download

memory/4700-68-0x0000015922150000-0x0000015922160000-memory.dmp

Download

memory/4700-63-0x00000159220A0000-0x00000159220B0000-memory.dmp

Download

memory/4700-64-0x0000015922140000-0x0000015922150000-memory.dmp

Download

memory/4700-468-0x0000015922190000-0x00000159221A0000-memory.dmp

Download

memory/4700-52-0x0000015922100000-0x0000015922110000-memory.dmp

Download

memory/4700-15-0x0000015922030000-0x0000015922040000-memory.dmp

Download

memory/4700-61-0x0000015922130000-0x0000015922140000-memory.dmp

Download

memory/4700-60-0x0000015922090000-0x00000159220A0000-memory.dmp

Download

memory/4700-56-0x0000015922110000-0x0000015922120000-memory.dmp

Download

memory/4700-2-0x0000015921DB0000-0x0000015922020000-memory.dmp

Download

memory/4700-13-0x0000015922020000-0x0000015922030000-memory.dmp

Download

memory/4700-58-0x0000015922080000-0x0000015922090000-memory.dmp

Download

memory/4700-57-0x0000015922120000-0x0000015922130000-memory.dmp

Download

memory/4700-11-0x0000015921D90000-0x0000015921D91000-memory.dmp

Download

memory/4700-55-0x0000015922070000-0x0000015922080000-memory.dmp

Download

memory/4824-96-0x00000189A9CB0000-0x00000189A9F20000-memory.dmp

Download

memory/4824-107-0x00000189A7B50000-0x00000189A7B51000-memory.dmp

Download

memory/4824-118-0x00000189A9F20000-0x00000189A9F30000-memory.dmp

Download

memory/4824-120-0x00000189A9F30000-0x00000189A9F40000-memory.dmp

Download

memory/4824-128-0x00000189A7B50000-0x00000189A7B51000-memory.dmp

Download

memory/4824-130-0x00000189A9CB0000-0x00000189A9F20000-memory.dmp

Download

memory/4824-129-0x00000189A9400000-0x00000189A9CB0000-memory.dmp

Download

memory/4824-131-0x00000189A9F20000-0x00000189A9F30000-memory.dmp

Download

memory/4824-132-0x00000189A9F30000-0x00000189A9F40000-memory.dmp

Download

memory/5692-330-0x00000224DA780000-0x00000224DB030000-memory.dmp

Download

memory/5692-329-0x00000224D8EA0000-0x00000224D8EA1000-memory.dmp

Download

memory/5692-321-0x00000224D8EA0000-0x00000224D8EA1000-memory.dmp

Download

memory/5860-266-0x000001C922800000-0x000001C922822000-memory.dmp

Download

memory/6112-608-0x000002980B010000-0x000002980B8C0000-memory.dmp

Download

memory/6112-630-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-411-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-474-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-521-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-543-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-609-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-612-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-625-0x000002980B010000-0x000002980B8C0000-memory.dmp

Download

memory/6112-628-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-629-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-359-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-640-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-642-0x000002980B010000-0x000002980B8C0000-memory.dmp

Download

memory/6112-645-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-648-0x000002980B010000-0x000002980B8C0000-memory.dmp

Download

memory/6112-660-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-661-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-663-0x000002980B010000-0x000002980B8C0000-memory.dmp

Download

memory/6112-677-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-680-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-688-0x000002980B8D0000-0x000002980B8D1000-memory.dmp

Download

memory/6112-690-0x000002980B010000-0x000002980B8C0000-memory.dmp

Download