Analysis
- user interaction
yes - max time kernel
956s - max time network
943s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 22:49
General
- Target audacity-win-3.7.8-64bit.exe
- Size 19.5MB
- Sample260804-2rnmsazwat
- SHA256 4a6d77f023c0209a396fcf2f3c7c04e240b6ba9897b3231a6ed18e14c10caa16
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 11 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 37 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: GetForegroundWindowSpam 5 IoCs
- Suspicious behavior: LoadsDriver 10 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\audacity-win-3.7.8-64bit.exe"C:\Users\Admin\AppData\Local\Temp\audacity-win-3.7.8-64bit.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CAND6MVBSC.tmp\audacity-win-3.7.8-64bit.tmp"C:\Users\Admin\AppData\Local\Temp\is-CAND6MVBSC.tmp\audacity-win-3.7.8-64bit.tmp" /SL5="$80216,18914073,1017856,C:\Users\Admin\AppData\Local\Temp\audacity-win-3.7.8-64bit.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Audacity\audacity.exe"C:\Program Files\Audacity\audacity.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Audacity\crashpad_handler.exe"C:\Program Files\Audacity\crashpad_handler.exe" "--crashreporter-path=C:\Program Files\Audacity\crashreporter.exe" --crashreporter-argument=-u=https://sentry.audacityteam.org/api/2/minidump/?sentry_key=37e6948db02f43ac856bf7edcbe9731d "--crashreporter-argument=-a=version=\"3.7.8\",sentry[release]=\"[email protected]\"" --database=C:\Users\Admin\AppData\Local\audacity\crashreports\ --metrics-dir=C:\Users\Admin\AppData\Local\audacity\crashreports\ --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7fffe72cfe98,0x7fffe72cfeb0,0x7fffe72cfec84⤵
- Executes dropped EXE
-
-
C:\Program Files\Audacity\audacity.exe"C:\Program Files\Audacity\audacity.exe" --host 506294⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b0 0x3101⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fffe86fc728,0x7fffe86fc734,0x7fffe86fc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,7411842493014529946,6112031756408871372,262144 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1948 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2160,i,15121179375814252513,17840803898237657793,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2188 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1412,i,18271381285607871823,12870452836448540506,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2584 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --metrics-shmem-handle=3080,i,10451174906457716848,12734878594229085392,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --metrics-shmem-handle=3084,i,7372699770686645845,1145250429704064244,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --metrics-shmem-handle=4424,i,14480208285484322005,2892634172451204618,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4224 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --metrics-shmem-handle=4688,i,6071319706150278908,10984702738534771204,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4704 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,7475631433111093165,2929307146507800467,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --metrics-shmem-handle=5912,i,10446221548433057274,2656614967167025979,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --metrics-shmem-handle=3356,i,16329759032607165085,611962115670425585,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --metrics-shmem-handle=3884,i,1534714552229314054,10915153672650432530,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --metrics-shmem-handle=6176,i,11939690495920980671,2098444716620161126,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,6997751833380444873,13521399552170765110,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5844 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,5734047488557421942,12862835055406043281,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3296,i,6364063359984988692,9986979521933094346,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3096 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --metrics-shmem-handle=3096,i,13975351133690368237,17833920525825641047,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6172 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --metrics-shmem-handle=6092,i,17811444646071231184,244561145410545386,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6336 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --metrics-shmem-handle=6168,i,6232723036382462626,15650729912023855835,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6100 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --metrics-shmem-handle=6316,i,1695072257197574611,4519897711812321282,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6312 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --metrics-shmem-handle=6492,i,139475920624861340,17834662669382030265,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6464 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --metrics-shmem-handle=6612,i,2361935251373859521,12924609302260357125,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6640 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6804,i,1953154447932776912,1881041118061230317,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6792 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7024,i,6384328508976424823,17455461104476551298,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7032 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --metrics-shmem-handle=6280,i,10662533502921263613,6747826515981461527,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=864 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --metrics-shmem-handle=6504,i,14424989273360415122,3969955818365602233,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --metrics-shmem-handle=6432,i,8080911195146724024,15125115418044292411,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7208 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6628,i,15966566612762073843,7247881586183249522,262144 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6296 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --metrics-shmem-handle=7388,i,2720430816475981657,17446427955489908349,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6456 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --metrics-shmem-handle=7292,i,6809797192182040864,16705770128236991578,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --metrics-shmem-handle=7544,i,6835157064655373373,17295419815811849791,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --metrics-shmem-handle=7868,i,4256266323021899405,4961496534794663564,2097152 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7880 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6136,i,10474034177095747114,13878418480313915477,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7212,i,17249040308984950855,15635797729997107581,524288 --field-trial-handle=1952,i,6840502301018615142,2487213324463672248,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3012 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4b0 0x3101⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap11494:114:7zEvent303451⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\rol-cld-re-201-1-0-1-senki\" -ad -an -ai#7zMap7236:114:7zEvent43821⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Downloads\rol-cld-re-201-1-0-1-senki\Roland.Cloud.RE-201.v1.0.1-SEnki\SEnki.nfo"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Downloads\rol-cld-re-201-1-0-1-senki\Roland.Cloud.RE-201.v1.0.1-SEnki\SEnki.nfo"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\rol-cld-re-201-1-0-1-senki\Roland.Cloud.RE-201.v1.0.1-SEnki\rol-cld-re-201-1-0-1-senki\" -ad -an -ai#7zMap1616:234:7zEvent36181⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Downloads\rol-cld-re-201-1-0-1-senki\Roland.Cloud.RE-201.v1.0.1-SEnki\rol-cld-re-201-1-0-1-senki\Roland Cloud RE-201 1.0.1.exe"C:\Users\Admin\Downloads\rol-cld-re-201-1-0-1-senki\Roland.Cloud.RE-201.v1.0.1-SEnki\rol-cld-re-201-1-0-1-senki\Roland Cloud RE-201 1.0.1.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-UFCTT.tmp\Roland Cloud RE-201 1.0.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-UFCTT.tmp\Roland Cloud RE-201 1.0.1.tmp" /SL5="$60BD8,24589192,831488,C:\Users\Admin\Downloads\rol-cld-re-201-1-0-1-senki\Roland.Cloud.RE-201.v1.0.1-SEnki\rol-cld-re-201-1-0-1-senki\Roland Cloud RE-201 1.0.1.exe"2⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files\Audacity\Audacity.exe"C:\Program Files\Audacity\Audacity.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Audacity\crashpad_handler.exe"C:\Program Files\Audacity\crashpad_handler.exe" "--crashreporter-path=C:\Program Files\Audacity\crashreporter.exe" --crashreporter-argument=-u=https://sentry.audacityteam.org/api/2/minidump/?sentry_key=37e6948db02f43ac856bf7edcbe9731d "--crashreporter-argument=-a=version=\"3.7.8\",sentry[release]=\"[email protected]\"" --database=C:\Users\Admin\AppData\Local\audacity\crashreports\ --metrics-dir=C:\Users\Admin\AppData\Local\audacity\crashreports\ --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7fffe854fe98,0x7fffe854feb0,0x7fffe854fec82⤵
- Executes dropped EXE
-
-
C:\Program Files\Audacity\Audacity.exe"C:\Program Files\Audacity\Audacity.exe" --host 521682⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Audacity\Audacity.exe"C:\Program Files\Audacity\Audacity.exe" --host 522902⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Program Files\Audacity\Plug-Ins\RE-201\Manual\RE-201 Manual E.pdf"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EC8F48F779FBAFC8D2C5CF5860DCD1AD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EC8F48F779FBAFC8D2C5CF5860DCD1AD --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:13⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8EF3115FC976D945C8EE59F9C72EF1DC --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=734D74E931E316E0E5233AC884B2AAB5 --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AFD2FBF37A9C67FA6E54C580C0D3B886 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AFD2FBF37A9C67FA6E54C580C0D3B886 --renderer-client-id=5 --mojo-platform-channel-handle=2440 --allow-no-sandbox-job /prefetch:13⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EE135FEE47D7DF86ABF87D1D360B8EF8 --mojo-platform-channel-handle=2600 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9F5DF363CFE68D8A4FBAA50C30A06EC0 --mojo-platform-channel-handle=2028 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{5AAABB05-F91B-4BCE-AB18-D8319DEDABA8}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Audacity\Plug-Ins\RE-201\Manual\RobotoFontLicense.txt1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Audacity.exe
is-R1M5FZ5GWL.tmp
is-0IJNA0HHVY.tmp
lib-audacity-application-logic.dll
lib-builtin-effects.dll
lib-crashpad-configurer.dll
lib-dynamic-range-processor.dll
lib-file-formats.dll
lib-graphics.dll
lib-import-export.dll
lib-ladspa.dll
lib-lv2.dll
lib-menus.dll
lib-music-information-retrieval.dll
lib-nyquist-effects.dll
lib-preference-pages.dll
lib-project-file-io.dll
lib-shuttlegui.dll
lib-tags.dll
lib-theme-resources.dll
lib-theme.dll
lib-url-schemes.dll
lib-viewport.dll
lib-vst.dll
lib-vst3.dll
lib-wave-track-fft.dll
lib-wave-track-paint.dll
lib-wx-init.dll
lib-wx-wrappers.dll
wxmsw313u_aui_vc_x64_custom.dll
wxmsw313u_core_vc_x64_custom.dll
wxmsw313u_html_vc_x64_custom.dll
wxmsw313u_qa_vc_x64_custom.dll
f_000016
f_000018
f_000019
f_00001b
f_00003a
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
the-real-index
audacity-win-3.7.8-64bit.tmp
audacity.cfg
audacity.cfg
audacity.cfg
audacity.cfg.bkp
audacity.cfg.bkp
pluginregistry.cfg
memory/532-7-0x0000000000B20000-0x0000000000C27000-memory.dmp
memory/532-636-0x0000000000B20000-0x0000000000C27000-memory.dmp
memory/532-0-0x0000000000B20000-0x0000000000C27000-memory.dmp
memory/1980-1090-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1980-1377-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/1980-1085-0x0000000000400000-0x00000000004D8000-memory.dmp
memory/2640-1401-0x00007FFFE5F70000-0x00007FFFE6A17000-memory.dmp
memory/2640-1402-0x00007FFFE5F70000-0x00007FFFE6A17000-memory.dmp
memory/2640-1400-0x00007FF6CF8A0000-0x00007FF6D07B2000-memory.dmp
memory/3288-1489-0x00007FF6CF8A0000-0x00007FF6D07B2000-memory.dmp
memory/3288-1491-0x00007FFFE5F70000-0x00007FFFE6A17000-memory.dmp
memory/3288-1490-0x00007FFFE5F70000-0x00007FFFE6A17000-memory.dmp
memory/3644-1376-0x0000000000400000-0x000000000071A000-memory.dmp
memory/3644-1091-0x0000000000400000-0x000000000071A000-memory.dmp
memory/3644-1098-0x0000000000400000-0x000000000071A000-memory.dmp
memory/4072-5-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/4072-13-0x0000000000370000-0x00000000007D1000-memory.dmp
memory/4072-635-0x0000000000370000-0x00000000007D1000-memory.dmp
memory/4072-9-0x0000000000B10000-0x0000000000B11000-memory.dmp
memory/4072-564-0x0000000000370000-0x00000000007D1000-memory.dmp
memory/4072-8-0x0000000000370000-0x00000000007D1000-memory.dmp
memory/4072-569-0x0000000000370000-0x00000000007D1000-memory.dmp
memory/4416-633-0x00007FF6CF8A0000-0x00007FF6D07B2000-memory.dmp
memory/4416-634-0x00007FFFE5D70000-0x00007FFFE6817000-memory.dmp
memory/4696-711-0x00007FF6CF8A0000-0x00007FF6D07B2000-memory.dmp
memory/4696-712-0x00007FFFE5D70000-0x00007FFFE6817000-memory.dmp
memory/5844-1609-0x00007FFFE5F70000-0x00007FFFE6A17000-memory.dmp
memory/5844-1608-0x00007FF6CF8A0000-0x00007FF6D07B2000-memory.dmp
memory/5844-1610-0x00007FFFE5F70000-0x00007FFFE6A17000-memory.dmp