a35aaef210119e8ad1f6c493fc3f578506641516f527f5c98ef3e28901a8f8f7

Analysis

user interaction
yes
max time kernel
131s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
App.js
Size 14KB
Sample260712-yam35sf14r
SHA256 a35aaef210119e8ad1f6c493fc3f578506641516f527f5c98ef3e28901a8f8f7
MD5 32b172e996955b526cc72445bb1ecf95
SHA1 662d035747827d626afe062c20b16321ab9b94ed
SHA512 5b85bdaecc58e18bdc8c5b16e40f52b9789c8c17d658cdd194b07821ed8c047390d8b58cc0213b817de42dac1701bbb79f7a5c9b4e7a4cf3a20abc29cfedadc2
SSDEEP 192:Io5UNS1UNg1Dli44F8BPRbd4bq+WfgkaGco4wJwBb2wy2HN/i6X8clNCGv:Io5UNQUN9vuBbs4EY+
TLSH
T1866274B948F10515F153A0752B9BB81A1F22B1436A89EE587B8C67607FC949CE2F33CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
95	discord.com
99	discord.com

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4400	Setup.exe
5868	Setup.exe
4400	Setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1632	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283585167338872"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	chrome.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
4400	Setup.exe
5868	Setup.exe
9248	chrome.exe
9248	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe
Token: SeShutdownPrivilege	1824	chrome.exe
Token: SeCreatePagefilePrivilege	1824	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe
1824	chrome.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 4960	1824	chrome.exe	88
PID 1824 wrote to memory of 1632	1824	chrome.exe	89
PID 1824 wrote to memory of 4628	1824	chrome.exe	90
PID 1824 wrote to memory of 4628	1824	chrome.exe	90
PID 1824 wrote to memory of 4916	1824	chrome.exe	91
PID 1824 wrote to memory of 4916	1824	chrome.exe	91
PID 1824 wrote to memory of 924	1824	chrome.exe	92
PID 1824 wrote to memory of 924	1824	chrome.exe	92
PID 1824 wrote to memory of 3940	1824	chrome.exe	93
PID 1824 wrote to memory of 3940	1824	chrome.exe	93
PID 1824 wrote to memory of 4520	1824	chrome.exe	94
PID 1824 wrote to memory of 4520	1824	chrome.exe	94
PID 1824 wrote to memory of 468	1824	chrome.exe	96
PID 1824 wrote to memory of 468	1824	chrome.exe	96
PID 1824 wrote to memory of 1008	1824	chrome.exe	97
PID 1824 wrote to memory of 2020	1824	chrome.exe	100
PID 1824 wrote to memory of 2020	1824	chrome.exe	100
PID 1824 wrote to memory of 3696	1824	chrome.exe	101
PID 1824 wrote to memory of 3696	1824	chrome.exe	101
PID 1824 wrote to memory of 760	1824	chrome.exe	102
PID 1824 wrote to memory of 760	1824	chrome.exe	102
PID 1824 wrote to memory of 3236	1824	chrome.exe	103
PID 1824 wrote to memory of 3236	1824	chrome.exe	103
PID 1824 wrote to memory of 4780	1824	chrome.exe	104
PID 1824 wrote to memory of 4780	1824	chrome.exe	104
PID 1824 wrote to memory of 3232	1824	chrome.exe	105
PID 1824 wrote to memory of 3232	1824	chrome.exe	105
PID 1824 wrote to memory of 4296	1824	chrome.exe	106
PID 1824 wrote to memory of 4296	1824	chrome.exe	106
PID 1824 wrote to memory of 3168	1824	chrome.exe	107
PID 1824 wrote to memory of 3168	1824	chrome.exe	107
PID 1824 wrote to memory of 2160	1824	chrome.exe	108
PID 1824 wrote to memory of 2160	1824	chrome.exe	108
PID 1824 wrote to memory of 3420	1824	chrome.exe	112
PID 1824 wrote to memory of 2656	1824	chrome.exe	119
PID 1824 wrote to memory of 1136	1824	chrome.exe	120
PID 1824 wrote to memory of 4376	1824	chrome.exe	121
PID 1824 wrote to memory of 9248	1824	chrome.exe	129

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\App.js
1⤵
PID:3240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffd691bc728,0x7ffd691bc734,0x7ffd691bc740
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,1204837449542132753,8952770013803514456,524288 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,5794173677850995868,18381380744252946769,262144 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,12414211941602610719,16341787384555323650,524288 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,16375013641375890111,8542310524626097180,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,7287389503189009198,6923282965673963180,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,17924645230699542767,10929082182132133125,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,7734593437141850844,1816322664117519938,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,483266611616572807,8332003161661191046,524288 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5780,i,14137609963139621033,10551457134065420320,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3476,i,7097900648287287140,4113324207388093175,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3292,i,17296904038230895487,3989461892986319380,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6172,i,3773889832709893017,14268839915852151833,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6568,i,8987230466034140827,17406494977862044171,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6348,i,6610867684647945167,17981458231861438021,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6696,i,9241571282169669341,1413722484970301201,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6652,i,1236416539586828994,13139029224002612115,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6868 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6376,i,5631614442419959905,17584323613113927170,2097152 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7164,i,690989441936195131,7479316040963919243,524288 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6824,i,8007554130617817345,3339287028398999951,524288 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6296,i,9649915265858624592,17465359628387480047,524288 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=7000,i,13306858805505302634,16612164857731795471,524288 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5752,i,10204613995406886207,12105434126181186777,262144 --field-trial-handle=2044,i,16844644011877912458,15068148432576862687,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:9248

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4820

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:212

C:\Users\Admin\Downloads\SETUP\Setup.exe
"C:\Users\Admin\Downloads\SETUP\Setup.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4400

C:\Users\Admin\Downloads\SETUP\Setup.exe
"C:\Users\Admin\Downloads\SETUP\Setup.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5187871ed7cb73b80484283b8363caa8d4213449b6a3688dc860aae9759af296
MD5 ab04b26890ebcea09ebbf29cd009e722
SHA1 fff458c81c3630316ec1693e4c7b7e2c88f59a23
SHA512 76ff5f97eb4d3e460e9c57f0b3785309cf5a55e2a54b020e502477699008fb95f931f2208a119e39b9c6815a3f020de22c5d4137535f5de8b9cde2987dc08a35
TLSH
T16DE0ABBEC9209D2B08FC031824080647E64023472B45845B7E3CC30D8FB86364486C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 d0f74e9dfa544e46fd1f4e321036290ca39db26b38b1f2a4c6f496bd0404c878
MD5 2140ae1b7f981bda1bb37cf3f05ffe9c
SHA1 187a18708761ab995a43453605a1a80fdc180978
SHA512 206cd4398fac114c8ae2fbafac1a99449267514f6d50e94c348cc69a9b1484d56b88c0b3271ba538925d7c5d8127b5bd4e2bee0ff40ba732a3293d6ed6c79615
TLSH
T1AC114295B29221A2CBCA4D7075D66C94703CF568FC176B4A8097D03872F2EEC2888060
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 71f07960793ee00f3ea3e22f9f5796971945dbe2fb1c9f8b496740881fbdcd1f
MD5 4d3730d3e2f1036e778c002593fc46ed
SHA1 cbf06035169d5e130777ca220f192c6fd972946b
SHA512 76d0691f7bc271158ad590d706d4d0a85e884e065e25a6ba16f93cc0d9e37ddc489859f9d69fdc349109bba797fc793c8271f87e86aa1f3f39abddbc1bf79b20
SSDEEP 384:DpWAbMcO8ba2lovOTBKFchaI7531S8jYZN6TX9ANgs/cgDTAvvwFC+vTJIEMovyJ:ezGCLhZ87t8q
TLSH
T1B672AEF3C3E88A2DC81156F9A7146E1FCE2D1A14432C3D26C9D5AF4B93E2472E255A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 65f77617e75158a427bedd969c955b51b23f25fb2fd7706da5200dfb9bbb527d
MD5 4a7ffaeb0cdc936e0609c0997b61ef49
SHA1 00afbd900857e8685ed76f06b8af2d8962501f03
SHA512 b2c3183eb5207b5fc16d03a5b098f95970d08ac7c2262584a3c1c4dc50604d5d5b06038a458e8ed7373ef5bd7e193c6aa4b85023ee85c9e333c9bc31d7f91d94
SSDEEP 192:/RMcBzSnPEnzhFt4Ev72ympAPRp2M+Bagy95Hsb+WNBE3c4Bu2v22cHRkw+VyIsH:/RMmzSPehEgQUXV7wt72u2cxW8
TLSH
T1B252D62FAA20657B9CDBC329F911BB63D7F5106266941E84EBFC8A1C14E75CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1132806f7971390675bd4a4b63202d8796e718ecd5e34c0f70acf4013a0101cb
MD5 a361d182945e3104929fcf31a5d2d782
SHA1 c60a77344b99e7478cebf6859520155572e855b0
SHA512 97ae8ccacae487410900ad4a81d1ace3b2fd4d16cf07ac4fc4b8bfa882890617ec7a7b1f2135c9b50bc813908bcb3a0bb9c7ea500bcd8f7b7692a0f1b94a8726
SSDEEP 192:5RMcBzSnPEnzhFtrrEv72ympAPRp2M+BkUVgy95Hsb+WNbWEM7BBu9KJ2y22cHR+:5RMmzSPehLgQUX67wQGe2N2cxZ8
TLSH
T14352B52FA920657B5CDBC229F811BB67E6F5206266841EC4FBFCCA1C14EB6DC2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 93a969d5494520a313d59c847d3ee10e51ce49e2c8cea4f6ea38850cfab527d0
MD5 65eaa0a57fc2a07c6f5f8e9c22429ba6
SHA1 83b5d3c038efb456e4191e45a08c6c1cf8b7d43f
SHA512 2f69609ebf02ccda7dd197a901863ecdf075cd94dce3ddcaf8f69f28aa522eed4a257c71ee04de563d2d250a18b8f7b4dfd5e90247d3586bee22fe519ccbce35
SSDEEP 384:Q+jM77KxkXqKf/pUZNCgVLH2HfgslAG7pLuLcSjW3XODM3+ErU3oPHGqkkpLtE:QOM77KxkXqKf/pUZNCgVLH2HfgsSG7pu
TLSH
T136720A67684C9A370F94CACCDC16BF4FACB5025B65ED886492FA5C1503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 c08485b069458a61baa4ce10600c59e4b17d4d78cd97b514e819ef9ade02fb23
MD5 95ad54f0524caba3f62bf1d6c528fb47
SHA1 a4f550b1d031d80bf46c1d96c38725e971295b43
SHA512 a7830b5b4260ee25b5f41c7aade133c81d30b3a89f32829baf301ca4414c77c769d88bbf85268f07d1b6064c1ebc33d0f057b53298fe58b5e799a103bdc93344
TLSH
T103B01250C0415521C44202B02182188C71587F21FB0A170143E4692ADC2B662D0180A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5877ea.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5877ea.TMP
Size 96B
SHA256 b3e3ec756b0f962be7a26cc1659b8b7f92492f063d400667c062f7e544d8e2d7
MD5 103108406ce3387480a09fbed373cd33
SHA1 d63cc4e52d73ae9ffa328d60aa91e9accc6d93bc
SHA512 1389bdb5c9308e485ec0b7f99525f4129150f933e6974f6890e92cca32b0f7c17f5427852ddc3aaae6cc25c655476f49d3d5cc2fc0827032a7b08886fc326fc3
TLSH
T1CEB02208C20AA202C0020BB82080E0CC3030CF22CB03020282F00FEACC20A300038020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 385b228f56693b9b1fc769620c3bff9fbeb48a5234a717fa3714cb608f1c8898
MD5 f5568df8ab3aff54ee1e873eb708037b
SHA1 cfdeccfd003e9739565d41540e858cf55884eb85
SHA512 1925527062493833a53b486d9623ccce28c2c5ff8a510b122e680affddeec3f77cb0db45660be58f409a7ff117be2b190ddcf7218863813e59828422a352f5d9
TLSH
T17CA0021816902BD3D9031BB4228112A1771058186756174B549310448DD868A431334C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 446c0fec2cfd29365133f59c8821044cf725d32aba1b2a8aa85432eea8145f47
MD5 e69a4e182d997f503dcdf743ea6105b8
SHA1 36ec930ec0eab95cd77d276f50ec431e3436b1d4
SHA512 e3091b24b9a112bebdc9cbf77637206f15b2d30ae6f7a7292b43da0112ddeffe5c64472496216109e230ce538fcbca4ccbd89932ceceb91b6c2b7e67bb655371
SSDEEP 3072:DocCeiqlYoMd4ECTHQilF0rEtUF15f7LXlKuIW3ARII3qfd7NtZL8cHQRZEQ6Spg:D1Ce0T4THtKE+1HXlKM03qZ/ZLW3Exn
TLSH
T1D5341232AF23DF36D966DB34F96B1F4F97B61698803082419A3E7B9F5C83851609358C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 d0fe230e79e3df669352e6343b55a6a55b8f3ac911ae954e195fb7dc8b8c69e0
MD5 90eadc8d0adf05254e04a4019dfe1c5b
SHA1 a840695350258d451725b6ba43b9fb02bec75d7b
SHA512 a0ad6fe5d03b623befcf466a4f25bf6ef251e8f47483bd12b9cd5ed4823eba2161dead891b2af8c8af01bbd133fab9649b96d9d6f29cf32920390ad36b70121b
SSDEEP 1536:TCQyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbjf:bqfd7NtZL8cHQRZEQ6Spsk
TLSH
T181C30237DBC21F339D96CB60B9530FD697F644A99034D301AA6D77AF6C83491644289C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 6334ddef388fddcbdc2fc4a6de84a929dd47717cc185a1365b9ad630434414ce
MD5 c3752d51631f79213b6787a74fabc024
SHA1 a59b53b8f702d2a5f50e4cb1c8b8817098129bfe
SHA512 7ff22f7231c4e3bb33fcdac89faa269de67128f762f35f7d8fe2acc58475ca22388be7e07e7aaa53590ae1f90e357310e14de0e5a5f120196ced7a8fd1794376
SSDEEP 3072:NocCeiqlYoMd4ECTHQilF0rEtUF15f7LXlKuIW3ARII3qfd7NtZL8cHQRZEQ6Spg:N1Ce0T4THtKE+1HXlKM03qZ/ZLW3Exn
TLSH
T174341232AF23DF36D966DB34F96B1F4F97B61698803082419A3E7B9F5C83851609358C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 ac944b6c3191b1cc99e1037917e71e81f5ca4b84783f5cb7c989ca7b8b868ca1
MD5 25cb42dba25930d12d0994ad5bb423d4
SHA1 c1cc166393453b9ba41238ded045ff1c9d434b11
SHA512 5b6009a9346a26c2ed7c82c557acfc0a8b9e1cfa32e7659aa1aaf3c4c92bcf45c6223eca07baf038aec826dc1532978a2e8b535dfc4420a5408e2f9e43ef366b
SSDEEP 3072:yocCeiqlYoMd4ECTHQilF0rEtUF15f7LXlKuIW3ARII3qfd7NtZL8cHQRZEQ6Spg:y1Ce0T4THtKE+1HXlKM03qZ/ZLW3Exn
TLSH
T19C341232AF23DF36D966DB34F96B1F4F97B61698803082419A3E7B9F5C83851609358C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 1db01b86e4e711587e57afabaaea757e68399c91974ff52ae2b9dbfffe71505e
MD5 c7e9c32f7e45e26258ce091cd32c22bf
SHA1 893b99406103520440caef8dcbc4ea201698f563
SHA512 ce6757c52d315a4f72123a8452e9b89a27835c0e41080654c45d44d68ca24f69d192bb42d08dcd2e6dcf72856b1d455afae6e47da4f6d317dec968c402054fd6
SSDEEP 3072:zz0cCeiqlYoMd4ECTHQilF0rEtUF15f7LXlKuIW3ARII3qfd7NtZL8cHQRZEQ6Sq:fJCe0T4THtKE+1HXlKM03qZ/ZLW3Exn
TLSH
T10F341236AF139F36DD76DB24F52B2F4B9AB257998030C245A93D3B9F9C83441949348C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/4400-1697-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1546-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-545-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-541-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-539-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-537-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-534-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-553-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-1679-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1672-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1665-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1658-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1651-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1644-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1637-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1630-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1623-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1616-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1609-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1602-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1709-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1704-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-531-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-1690-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1595-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1588-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1581-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1574-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1567-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1560-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1553-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-536-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-1539-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1532-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1525-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1518-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1511-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1504-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1497-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1490-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-1488-0x00000000004A0000-0x00000000004CE000-memory.dmp

Download

memory/4400-1485-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-1482-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-1479-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-1477-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-1476-0x000000007EFA0000-0x000000007EFA1000-memory.dmp

Download

memory/4400-2915-0x00000000003F0000-0x00000000003F6000-memory.dmp

Download

memory/4400-2914-0x0000000000550000-0x0000000000553000-memory.dmp

Download

memory/4400-2913-0x000000007F150000-0x000000007F151000-memory.dmp

Download

memory/4400-2900-0x000000007F130000-0x000000007F136000-memory.dmp

Download

memory/5868-2663-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-1712-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-1717-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-1734-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-2671-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-2666-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-2658-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-1720-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-1718-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-2657-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-1726-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-1722-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-2660-0x000000007F050000-0x000000007F051000-memory.dmp

Download

memory/5868-1715-0x000000007F050000-0x000000007F051000-memory.dmp

Download