xworm | f259428898724d766ddfc70b5822595f89638e9951d5aadd683eda82d2b90009

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/06/2026, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MasonRAT.exe
Size 17.6MB
Sample260625-yvanjsfv2m
SHA256 f259428898724d766ddfc70b5822595f89638e9951d5aadd683eda82d2b90009
MD5 df9aecbb660bd283cc4a3574b5a9f3db
SHA1 3364393967f08eef69c167d1700648225adc1667
SHA512 4dec850d7f657829643bc6753d878d77fe1fcfe0864f4d32c53b8172634a5b31504d9f172de1863554015e5db1b5f80b1a848d62a599a8734a1faa309bac647c
SSDEEP 393216:1i1Y7k3MSW5AxiQaGiIDT0QQ+y2G8lhT/n9a7/hlEh847kZcHeWGE2wx:1LI7i8ieT0QJzhT/nEo8byI2
TLSH
T14C0733E3CA1A95FACF0011BF621C09316608B896764AB93737E52CF7BBB3955C8119D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery xworm rat trojan

Malware Config

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral3/files/0x001a00000002b524-15.dat	family_xworm
behavioral3/memory/5112-26-0x0000000000FE0000-0x0000000000FFC000-memory.dmp	family_xworm

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
4208	MasonRAT.exe
5112	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1704	4208	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MasonRAT.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268916752416959"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2088	EXCEL.EXE
3904	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3156	EXCEL.EXE
3156	EXCEL.EXE
5220	chrome.exe
5220	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3904	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	svchost.exe
Token: SeDebugPrivilege	5112	svchost.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe
Token: SeShutdownPrivilege	5220	chrome.exe
Token: SeCreatePagefilePrivilege	5220	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
3904	vlc.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe
5220	chrome.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
4972	OpenWith.exe
4588	OpenWith.exe
2088	EXCEL.EXE
2088	EXCEL.EXE
3156	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
2088	EXCEL.EXE
3904	vlc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4208	5088	MasonRAT.exe	81
PID 5088 wrote to memory of 5112	5088	MasonRAT.exe	82
PID 5220 wrote to memory of 4924	5220	chrome.exe	97
PID 5220 wrote to memory of 1756	5220	chrome.exe	98
PID 5220 wrote to memory of 1756	5220	chrome.exe	98
PID 5220 wrote to memory of 4856	5220	chrome.exe	99
PID 5220 wrote to memory of 3632	5220	chrome.exe	100
PID 5220 wrote to memory of 3632	5220	chrome.exe	100
PID 5220 wrote to memory of 1988	5220	chrome.exe	101
PID 5220 wrote to memory of 1988	5220	chrome.exe	101
PID 5220 wrote to memory of 756	5220	chrome.exe	102
PID 5220 wrote to memory of 756	5220	chrome.exe	102
PID 5220 wrote to memory of 840	5220	chrome.exe	103
PID 5220 wrote to memory of 840	5220	chrome.exe	103
PID 5220 wrote to memory of 2148	5220	chrome.exe	105
PID 5220 wrote to memory of 2148	5220	chrome.exe	105
PID 5220 wrote to memory of 5464	5220	chrome.exe	106
PID 5220 wrote to memory of 5464	5220	chrome.exe	106
PID 5220 wrote to memory of 4132	5220	chrome.exe	107
PID 5220 wrote to memory of 4132	5220	chrome.exe	107
PID 5220 wrote to memory of 4552	5220	chrome.exe	108
PID 5220 wrote to memory of 4820	5220	chrome.exe	111
PID 5220 wrote to memory of 4296	5220	chrome.exe	112
PID 5220 wrote to memory of 3640	5220	chrome.exe	113

C:\Users\Admin\AppData\Local\Temp\MasonRAT.exe
"C:\Users\Admin\AppData\Local\Temp\MasonRAT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Roaming\MasonRAT.exe
  "C:\Users\Admin\AppData\Roaming\MasonRAT.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 1256
    3⤵
    - Program crash
    PID:1704
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4208 -ip 4208
1⤵
PID:5344

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4588

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\InitializeDebug.xltm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2088

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\InitializeDebug.xltm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3156

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UnregisterSplit.3gp2"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3904

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RestartRedo.wma"
1⤵
PID:4760

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WatchConnect.ADTS"
1⤵
PID:4828

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\MergeReceive.mpv2"
1⤵
PID:5236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe96c2c728,0x7ffe96c2c734,0x7ffe96c2c740
  2⤵
  PID:4924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,7083226395280408948,14665737895698640018,262144 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2264,i,303347974972190078,7806153516781773097,524288 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,612847839655483632,1411204733986814682,524288 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,842751499508097749,4122213593862964909,2097152 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3340,i,13998722880670216055,12402719021254497119,2097152 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4136,i,2004608273015104368,12620555777995550598,2097152 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4312 /prefetch:9
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,1320355586578246806,18286831727103482342,2097152 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4900,i,8401148831274451586,511444608169924957,524288 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4140 /prefetch:14
  2⤵
  PID:5464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,9561226694445908068,12176506122672249085,524288 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,10488578259704582636,5298267928403671936,524288 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5172 /prefetch:14
  2⤵
  PID:4552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5872,i,8369050493885245794,15614892585564884738,524288 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,5346185688557563540,1759918226450441135,524288 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,16003921923017480446,120934151905635486,524288 --field-trial-handle=1940,i,9069267164902261335,7989715808751721610,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:3640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 1ca05d44ccc6ff78641ca15073abfc262ef9a6809fc1ae54be9deece302df0da
MD5 c370b20625c99c36cad65cabded92a8a
SHA1 7c410c73eea6ab4ef5030801625333d444d2932d
SHA512 9ff36b65e0f41502d28ad655c211cb59452e30bafbf5dfa947e34f604af5c5d1b387e7086e95ac2746c423724f10988f8f3646fec22902ea4e9599a6ea09e061
TLSH
T195F054A240BCF050B9CF99AD1DF457383830D0F954946453E8E8C5756D8557AAF1B42B
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 ab23c803c6117d03052b0cb58554aef75e6a6b977c619b8a2665967d552030d5
MD5 5fa6fe75c96f5f6b09e31c2b0a83d73b
SHA1 a6cc4bb414c518440aabe1ce5d12fce55c79bf3c
SHA512 32fb3f1832e5d64f0e879f8eb85bbdaa58e1da7ba020a0be8961b09cb02c8b3cab01a3fbb3632c85624578fe7723a6f4801c8bebdf58efb17cbc16c5e4c3d00d
TLSH
T157E0C02015F6011CF1F1C13847D67570A9D6F0111814E7B91BE477096B07640EC12D31
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 546e2f4abf8792fcc1a6c4b4fee33516674f28141adc174fdd5e5098aee06333
MD5 c37c31e17082dd1909243716ab14c3ae
SHA1 f336f17c70770a0084d2c3d6e36c20666318773d
SHA512 54fa6fab31633d8bbbe026d734dab891bc88cbe44f61f6ccbed58a918a88feb09e04a7d058b0dd720a27eaa40e3a410de5477e7590e7b039097f9f2d446746e4
TLSH
T10FE02BA6C822DC270CFE5B6C61914345D66013572B815D4F3B3C810C8FB1A3A824985C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 04da6aeb3d1598d1ee84428cc218e64cce320a91cb26a5f1794c3ab426b7cc98
MD5 1857351bb13bfd713a957bcd19433265
SHA1 a300e856dc3def87c498b237a388407aa5463c1a
SHA512 4751ee25f985f53ffdcf7a9c0dccf31d6596df325c545a1bad9caebf5056dc66bbc010428ca1108cb51ee3b1c25e0997d779785de5b9a363419cbd2aa945d273
SSDEEP 192:iRb9zvxAtRJUPav7HhAPRp2y9DHsb+WNnQe0wkjkehaVyIsnAUgtaJ:iRb9LatRe2j8XR5w50Jj/a8
TLSH
T15842E83EEA20693B5CD7C229FA617B57D7F5103121C42E88EAFC8A2C05D79DC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 847ffde5981321d5cdac3633cd773e914c657fc5c7f9cbb8a280f5e6824b2387
MD5 a159edcb7b8624cb1968710cdca70dc8
SHA1 03faa98a7df43a0f234add239caa6bcd5a4b2260
SHA512 37f94cefeb26532087844841c61e848b33bec9fae0ab95daccc1782b887043f02e092e2352aeed94e4f59a5b27946007b2c74727c965a7231c82f3e400604e53
SSDEEP 192:iRb9zvxAtRJUPMv7HhAPRp2y9DHsb+WNnQe0QkjkehYVyIsnAUgraJ:iRb9LatReYj8XR5w50pj/8e
TLSH
T10742E93EF920693B6CD7D629FA657B57D7F5102221C01E88EAFC8A2C15E79DC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 803c6b2a4d9edd7c10da8ba909d5fa4210e5d313639144de247281299a5f7918
MD5 3cb4b7616fea6ebd24d81fa15f04015e
SHA1 6d3e77c99790408f0eebd865478c41981ed86bf9
SHA512 fe74c84ff56e3a517f9e7228b37320994f78233d409df21364e914d8a88207d0ebac3fc6ea047d9d6c85de7c098a30034efa6e9851d5fa4dcc0cb4335d31d528
SSDEEP 192:iRb9zvxAtRJUxbv7HpAPRp2y9DHsb+WNnQe0wkjkehaVyIsnAUgtaJ:iRb9LatRKjjUXR5w50Jj/a8
TLSH
T1D142D73EEA20693B5CD7C229FA657B57D7F5102221D02E88EAFC8A2C15D79DC221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
MD5 a9125c26694a66613be5174b13bd716c
SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
TLSH
T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d3fcba656e2f6d43cac705bbbe8c4835a72d01a80371c9582ff99aab656184e1
MD5 5199a4e8e187afe4ff32ae6f8db760da
SHA1 b81b8bb7ec0fb9a33a0f152ac43bb018bee7bff9
SHA512 3e37490aa781f6f61f4909737ccf065bddcb8ec6ca75cfdee2c8bcb7de1b085bcad46063fe41a762256d4507739b112effed559fddce1bf1601edf82dfd300ff
TLSH
T1EBB0120080015111C08202F0216254C871245F10BF0A170543F46F22D8761A18014091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3133.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a3133.TMP
Size 96B
SHA256 66e90760873e9258d9ee0b269968f31ed363c25fb467d719b3946aec94cba321
MD5 441c6460a7d18910dc1e457f68f03910
SHA1 da6d51c3ff2cc6fb6d074595fa79532266efc196
SHA512 492a63322c97ef5b20e9513021455eafbff5ae423669c52fd8a92f2f07e16bee11aa122231c9de5fa8889d8dc387c8b02d9ae119a6d9da4e3643d95bd70512a7
TLSH
T1A0B02208C0032323C00223F020B088C832A0CF22E303022382E00EABEC3023080230B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 1d456294e62418868a2307bf5ca36570334399c23eb741b24e447a5753241a41
MD5 b3a7653575fccb3a4d164143ea795037
SHA1 32fc4c25ed1932ed3c46a6918e6d589a8b043e5f
SHA512 13babb136b55aee9272a6776ece2502bdb52716b00a7764e4147a9b4e7f5bae4e466040c10f605b310ecbad4caf40830295cddbca3019ccfa7d6de4422412ac0
SSDEEP 6144:P2EV78nZvIhhiYAPm7Rkm1tYpBeh2BAoW:eieR6iYA+9oBGcAoW
TLSH
T16C34122B5E39E8729AFE7729600D0F1F6DF24D628505C4A3C6C46E0933FD98C2A45E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 4b175f359960ac52474285e50284f58a99296db19d1eabe225344b4e0e2339b3
MD5 27b56e2f66a7ff8bb787a7f65cfb228b
SHA1 d08ecde4cd646d3f38a2a956abafc8cfcd905aa8
SHA512 78430619a6a849cccd354c38d5658bae80ff5fc8f2b7a562464d44f6bc12131fc8262fc84346f9cd6b3d7fcefdd3456b1e4a634c463627d8caf5dc60e95bfe89
SSDEEP 6144:e2EV78nZvIhhiYAPm7Rkm1tYpBeh2BAoW:JieR6iYA+9oBGcAoW
TLSH
T1B934122B5E39E8729AFE7B29600D0F1F6DF24D628505C4A386C46E0933FD98C2A45E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3b4fcba4dfabb8f759e63d7d5d78b50b2801be191c095f2c3ab6c0a77986d583
MD5 b6f4eb652cba5f861c18bb72fc14edd9
SHA1 5eddef42a8aa56df1f9423ef4d8123ec55307e11
SHA512 3084e69f8370e3ca7f562f10caf9070bad147a3fda5fb2be48e20026435d9fc83baf18cd484949c738b601b9db22bddcb5b1b43185310161d3c81726e42b8cc4
SSDEEP 3072:fGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Om7Rkm1tYpBeh2BAo+
TLSH
T178C3123B5D71A93658B5B70EB04D0B1F1EF149A6C930DE82C8D85B0477FA7CC0A05A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

264FCEC8-CEE1-466B-8929-9350F2807044

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\264FCEC8-CEE1-466B-8929-9350F2807044
Size 190KB
SHA256 111437b9cee4d35c1b8d15bef57411678ca2c986347b74a958a45ce864e2d2e9
MD5 297a3381995463e50adb6db0ef7f8ffa
SHA1 6e3b8d064afa0583d1105643e15a8264280de230
SHA512 350cbbd24bdab4ea3f17d4929e11f9e5628ce545317269ceb057419a4964a4aac32e85a84e6e1580d13b7ae9a29ea7a8b96d39f0ba3260e68829ff4dfea8e5d9
SSDEEP 1536:WrVe3b3yFK13SN1bQxsghElqe7HW6Dkjj/mb9cAZl1p5ihs7VXXhEKD0aO7qamZG:Tbe7HW6Dkjj/uX257cU
TLSH
T19B1402A6B2C75C628B33049D5B57A094FE6E12A708D5202873FAF3578FF2E1CB547291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

excel.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db
Size 24KB
SHA256 73d664538ac2290493d4fcdffd5826f26cd87c3e82c1c77d75ee3f2372da4838
MD5 a5ab56cdbbb509f21e44c34135a81410
SHA1 776b109d54c621b6e0d3731c18540e296b6e6da5
SHA512 9886482a82c15870746fce2570a4172d9b9f68ebde942bcb3d8551383a5d592044ece9fcf1f8380a5d98f3f33330e5a01a67d95219f73d71605232d6cf78e1c2
SSDEEP 96:PjVG4t9yBEi4g27tAPBEidg271CgKAQQpZ+:P4YwSivHPSiOCR1Jb
TLSH
T1B4B295DB93706032E78253B58EE707293775A4C2177502C8A0DD1C22A9E536BF6734EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MasonRAT.exe

Path C:\Users\Admin\AppData\Roaming\MasonRAT.exe
Size 17.5MB
SHA256 8c24c948353d4449b451f7832fba4b8bb44b18711a83d589544c13142d4f326e
MD5 deff6a06ee2b318d924a89328527cfd9
SHA1 00be42dba0e257fe1aaaebac462be88b0120d15d
SHA512 699211a290219f7a8b89ada51f79c5ce02b4f35ef348b8f717301d6da3b9e6d582255720bc17bf70741e96e7948268f2341a90f12a4f6846e77bb5a311b42d9b
SSDEEP 393216:eyuW9Z89ePbmJY+7HgYw7Tb2p82QoHQTfUpF/ewVa/RTX6D:edaaemO+TH22prQIOspF7SRb6
TLSH
T105071248B03EBEFDFDADDB3B41881F069BF917B3871886DA7944229977E1241640921F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 90KB
SHA256 f27d850d8d2517bd766e5204e134cf467d67ca7625a6a7996c6110fdd7a3821f
MD5 f2c9864b28f9c376c1111095dc4cf6b0
SHA1 92a93ef50fa75ed09fcc00b2404eaaf80c25ffdd
SHA512 efa3f01a83e314e524d2f3d164dd634ea69cafdb373fde14663c3e804a05814056701b74d964423436368ad0c6d4aba3d152f996d49bef8944b4d4d176eefb8c
SSDEEP 1536:+iXIpF5WkdtT9rCw7ZczdBum6uvm1vWqiLm5aRIbJzBPWeP6:VXsF51CnYG6e8aebJzdWB
TLSH
T1EF936B8EFBA14995D1AC4F7385A3910401B9D0A7A833F7BB14DC1EE16CB64D8DB4FA60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-41-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/2088-42-0x00007FFE85DD0000-0x00007FFE85DE0000-memory.dmp

Download

memory/2088-43-0x00007FFE85DD0000-0x00007FFE85DE0000-memory.dmp

Download

memory/2088-40-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/2088-37-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/2088-38-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/2088-39-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/3156-70-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/3156-69-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/3156-71-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/3156-72-0x00007FFE88110000-0x00007FFE88120000-memory.dmp

Download

memory/4208-30-0x0000000006DF0000-0x0000000007DDC000-memory.dmp

Download

memory/4208-28-0x0000000001EF0000-0x0000000001F00000-memory.dmp

Download

memory/4208-27-0x00000000002A0000-0x000000000141E000-memory.dmp

Download

memory/4208-31-0x000000000B720000-0x000000000BCC6000-memory.dmp

Download

memory/4208-32-0x0000000007EC0000-0x0000000007F52000-memory.dmp

Download

memory/4208-33-0x0000000008000000-0x000000000809C000-memory.dmp

Download

memory/4760-107-0x00007FFEA2050000-0x00007FFEA206A000-memory.dmp

Download

memory/4760-104-0x00007FFEACE50000-0x00007FFEACE68000-memory.dmp

Download

memory/4760-98-0x00007FFEA32C0000-0x00007FFEA3392000-memory.dmp

Download

memory/4760-97-0x00007FFEAEEE0000-0x00007FFEAEEF1000-memory.dmp

Download

memory/4760-96-0x00007FFEB0170000-0x00007FFEB0184000-memory.dmp

Download

memory/4760-95-0x00007FFEA1C30000-0x00007FFEA1FC0000-memory.dmp

Download

memory/4760-93-0x00007FFEB81C0000-0x00007FFEB81E2000-memory.dmp

Download

memory/4760-91-0x00007FFEBBFC0000-0x00007FFEBBFD1000-memory.dmp

Download

memory/4760-111-0x00007FFEA1780000-0x00007FFEA1818000-memory.dmp

Download

memory/4760-108-0x00007FFEA2030000-0x00007FFEA2041000-memory.dmp

Download

memory/4760-100-0x00007FFEA1B40000-0x00007FFEA1C28000-memory.dmp

Download

memory/4760-103-0x00007FFEA3240000-0x00007FFEA326F000-memory.dmp

Download

memory/4760-102-0x00007FFEA3270000-0x00007FFEA32B1000-memory.dmp

Download

memory/4760-89-0x00007FFEB79B0000-0x00007FFEB79E4000-memory.dmp

Download

memory/4760-90-0x00007FFEA2540000-0x00007FFEA27F6000-memory.dmp

Download

memory/4760-88-0x00007FF6D77E0000-0x00007FF6D78D8000-memory.dmp

Download

memory/4760-92-0x00007FFEB8B90000-0x00007FFEB8BA9000-memory.dmp

Download

memory/4760-94-0x00007FFEA8DA0000-0x00007FFEA8DCB000-memory.dmp

Download

memory/4760-114-0x00007FFE9A310000-0x00007FFE9A555000-memory.dmp

Download

memory/4760-113-0x00007FFEA1700000-0x00007FFEA1725000-memory.dmp

Download

memory/4760-112-0x00007FFEA1730000-0x00007FFEA177F000-memory.dmp

Download

memory/4760-110-0x00007FFEA1820000-0x00007FFEA1A2B000-memory.dmp

Download

memory/4760-109-0x00007FFEA1A30000-0x00007FFEA1A41000-memory.dmp

Download

memory/4760-106-0x00007FFEA31E0000-0x00007FFEA320D000-memory.dmp

Download

memory/4760-105-0x00007FFEA3210000-0x00007FFEA3236000-memory.dmp

Download

memory/4760-99-0x00007FFEA2070000-0x00007FFEA2306000-memory.dmp

Download

memory/4760-101-0x00007FFEA1A50000-0x00007FFEA1B33000-memory.dmp

Download

memory/4828-125-0x00007FFEA2540000-0x00007FFEA27F6000-memory.dmp

Download

memory/4828-123-0x00007FF6D77E0000-0x00007FF6D78D8000-memory.dmp

Download

memory/4828-136-0x00007FFEA1A50000-0x00007FFEA1B33000-memory.dmp

Download

memory/4828-135-0x00007FFEA1B40000-0x00007FFEA1C28000-memory.dmp

Download

memory/4828-134-0x00007FFEA2070000-0x00007FFEA2306000-memory.dmp

Download

memory/4828-133-0x00007FFEA32C0000-0x00007FFEA3392000-memory.dmp

Download

memory/4828-132-0x00007FFEAEEE0000-0x00007FFEAEEF1000-memory.dmp

Download

memory/4828-131-0x00007FFEB0170000-0x00007FFEB0184000-memory.dmp

Download

memory/4828-130-0x00007FFEA1C30000-0x00007FFEA1FC0000-memory.dmp

Download

memory/4828-129-0x00007FFEA8DA0000-0x00007FFEA8DCB000-memory.dmp

Download

memory/4828-128-0x00007FFEB81C0000-0x00007FFEB81E2000-memory.dmp

Download

memory/4828-127-0x00007FFEB8B90000-0x00007FFEB8BA9000-memory.dmp

Download

memory/4828-126-0x00007FFEBBFC0000-0x00007FFEBBFD1000-memory.dmp

Download

memory/4828-142-0x00007FFEA2050000-0x00007FFEA206A000-memory.dmp

Download

memory/4828-137-0x00007FFEA3270000-0x00007FFEA32B1000-memory.dmp

Download

memory/4828-138-0x00007FFEA3240000-0x00007FFEA326F000-memory.dmp

Download

memory/4828-147-0x00007FFEA1730000-0x00007FFEA177F000-memory.dmp

Download

memory/4828-141-0x00007FFEA31E0000-0x00007FFEA320D000-memory.dmp

Download

memory/4828-143-0x00007FFEA2030000-0x00007FFEA2041000-memory.dmp

Download

memory/4828-144-0x00007FFEA1A30000-0x00007FFEA1A41000-memory.dmp

Download

memory/4828-139-0x00007FFEACE50000-0x00007FFEACE68000-memory.dmp

Download

memory/4828-146-0x00007FFEA1780000-0x00007FFEA1818000-memory.dmp

Download

memory/4828-140-0x00007FFEA3210000-0x00007FFEA3236000-memory.dmp

Download

memory/4828-148-0x00007FFEA1700000-0x00007FFEA1725000-memory.dmp

Download

memory/4828-145-0x00007FFEA1820000-0x00007FFEA1A2B000-memory.dmp

Download

memory/4828-124-0x00007FFEB79B0000-0x00007FFEB79E4000-memory.dmp

Download

memory/5088-0-0x0000000000DB0000-0x0000000001F46000-memory.dmp

Download

memory/5112-26-0x0000000000FE0000-0x0000000000FFC000-memory.dmp

Download

memory/5112-35-0x000000001EE10000-0x000000001EE5E000-memory.dmp

Download

memory/5112-36-0x000000001DFF0000-0x000000001DFF6000-memory.dmp

Download