Analysis
- user interaction
yes - max time kernel
752s - max time network
753s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 11:14
General
- Target HARIKA MARK 12.png
- Size 27KB
- Sample260804-nce57svscs
- SHA256 51d46600a699cb3f7e4376c5f3cd0bdbfb3ea82b98982127815ea95407b72f08
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 64 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 47 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 62 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\HARIKA MARK 12.png"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9c86dc728,0x7ff9c86dc734,0x7ff9c86dc7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,1105173426868134431,15538572484121479804,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,6194555796340856938,8057520955491669314,262144 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2184 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2436,i,13591231718953212816,11666290729759232912,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2596 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,7079365853029432573,17741043269168543187,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,15312815489763671606,13952093719875032074,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4584,i,8298597105384412024,9405236446658342970,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,16277590115771727678,16576519492141284984,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5376 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5452,i,7612631271619088536,126931807635572764,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3420,i,5122543317506134036,18150806515030132308,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3240,i,14706055712112212107,1188750658420098570,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3444,i,8968218101297725005,12968162259382601896,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3356 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5820,i,16057212937340548353,8587057204324103667,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6124,i,15565486661784668175,3119670416569343614,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,16172672016522574297,17432819608833785040,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,12265507166837014199,15905133504438385560,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6076 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6000,i,12510535066224810185,15818650468392036561,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6012 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6744,i,4571207081060089775,7314018840313265373,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6748 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6560,i,7687608716498286940,9451018062420190367,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6840,i,4214613670348611644,13618408789529441420,262144 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=1160,i,6203390939900047009,13680033966582102163,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4496,i,10857064275036450345,3836026468000134356,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6272 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6496,i,6709786621174681142,17913418276247079984,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6668 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7112,i,17696033884217726722,2822333583192873359,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7108 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6460,i,16884784330705116748,48357669477684839,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7000 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6528,i,8878936981459237454,5309232357805061703,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7216 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7336,i,5974421068844184230,10725466133510140735,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7176 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7472,i,2357274980421072889,2007221342146688126,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6584 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7416,i,11073119137258896605,791831368650371752,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7396 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7508,i,1610570492077234867,15100127957669934776,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7152 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7084,i,10569851528845165996,10467025571072415694,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7620 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6580,i,4196725133343363397,13510674138154266620,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7636 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7360,i,9084207942749397546,5414184412570467207,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7384,i,6008703722080148634,10943966071452346238,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7696 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6896,i,5596393244839535586,6986151946193856611,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6908 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7048,i,4151757027891009532,12331193412106994343,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5820,i,14545751767477492994,13263324821932431717,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7628,i,9305896464236465687,6392547412684820898,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=3112,i,15981049142523453955,17910646924862423272,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7788 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=3232,i,4087327229766931134,4070682901455355269,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7744 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=4632,i,11592150723153593183,13899134826521416433,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6504 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=3480,i,4284983845893194152,7792931721163857107,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6052 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8016,i,3575973581663163932,3561177192919803643,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8068 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6652,i,8338067705957771445,11561163671316269097,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6816 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\SKlauncher-3.2.18_Setup.exe"C:\Users\Admin\Downloads\SKlauncher-3.2.18_Setup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-ONFHZKGA8G.tmp\SKlauncher-3.2.18_Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-ONFHZKGA8G.tmp\SKlauncher-3.2.18_Setup.tmp" /SL5="$D01EC,2154364,841216,C:\Users\Admin\Downloads\SKlauncher-3.2.18_Setup.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe"C:\Users\Admin\AppData\Roaming\sklauncher\jre\bin\javaw.exe" -Xmx512M -jar "C:\Users\Admin\AppData\Roaming\sklauncher\SKlauncher.jar"4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SYSTEM32\reg.exereg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme5⤵
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows-x64\java-runtime-delta\bin\javaw.exeC:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows-x64\java-runtime-delta\bin\javaw.exe -XshowSettings:properties -version5⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows-x64\java-runtime-delta\bin\javaw.exeC:\Users\Admin\AppData\Roaming\.minecraft\runtime\java-runtime-delta\windows-x64\java-runtime-delta\bin\javaw.exe -Xdiag -XX:+UnlockExperimentalVMOptions -XX:+UseG1GC -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=16M -Xmx4096m -javaagent:C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar -DMcEmu=net.minecraft.client.main.Main -Dlog4j2.formatMsgNoLookups=true -Djava.rmi.server.useCodebaseOnly=true -Dcom.sun.jndi.rmi.object.trustURLCodebase=false -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false -Dsklauncher.discordrpc=true -Dsklauncher.gametype=fabric -Dsklauncher.minecraft=1.21.4 -Dsklauncher.dns=true -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Djava.library.path=C:\Users\Admin\AppData\Roaming\.minecraft\versions\fabric-loader-0.19.3-1.21.4\fabric-loader-0.19.3-1.21.4-natives-1043973975919 -Djna.tmpdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\fabric-loader-0.19.3-1.21.4\fabric-loader-0.19.3-1.21.4-natives-1043973975919 -Dorg.lwjgl.system.SharedLibraryExtractPath=C:\Users\Admin\AppData\Roaming\.minecraft\versions\fabric-loader-0.19.3-1.21.4\fabric-loader-0.19.3-1.21.4-natives-1043973975919 -Dio.netty.native.workdir=C:\Users\Admin\AppData\Roaming\.minecraft\versions\fabric-loader-0.19.3-1.21.4\fabric-loader-0.19.3-1.21.4-natives-1043973975919 -Dminecraft.launcher.brand=java-minecraft-launcher -Dminecraft.launcher.version=1.6.93 -cp C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm\9.10.1\asm-9.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-analysis\9.10.1\asm-analysis-9.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-commons\9.10.1\asm-commons-9.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-tree\9.10.1\asm-tree-9.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\ow2\asm\asm-util\9.10.1\asm-util-9.10.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\fabricmc\sponge-mixin\0.17.3+mixin.0.8.7\sponge-mixin-0.17.3+mixin.0.8.7.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\fabricmc\intermediary\1.21.4\intermediary-1.21.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\fabricmc\fabric-loader\0.19.3\fabric-loader-0.19.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\fasterxml\jackson\core\jackson-annotations\2.13.4\jackson-annotations-2.13.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\fasterxml\jackson\core\jackson-core\2.13.4\jackson-core-2.13.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\fasterxml\jackson\core\jackson-databind\2.13.4.2\jackson-databind-2.13.4.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\oshi\oshi-core\6.6.5\oshi-core-6.6.5.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\github\stephenc\jcip\jcip-annotations\1.0-1\jcip-annotations-1.0-1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\code\gson\gson\2.11.0\gson-2.11.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\failureaccess\1.0.2\failureaccess-1.0.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\google\guava\guava\33.3.1-jre\guava-33.3.1-jre.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\ibm\icu\icu4j\76.1\icu4j-76.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\microsoft\azure\msal4j\1.17.2\msal4j-1.17.2.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\authlib\6.0.57\authlib-6.0.57.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\blocklist\1.0.10\blocklist-1.0.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\brigadier\1.3.10\brigadier-1.3.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\datafixerupper\8.0.16\datafixerupper-8.0.16.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.0.29\jtracy-1.0.29.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\jtracy\1.0.29\jtracy-1.0.29-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\logging\1.5.10\logging-1.5.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\patchy\2.2.10\patchy-2.2.10.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\mojang\text2speech\1.17.9\text2speech-1.17.9.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\nimbusds\content-type\2.3\content-type-2.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\nimbusds\lang-tag\1.7\lang-tag-1.7.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\nimbusds\nimbus-jose-jwt\9.40\nimbus-jose-jwt-9.40.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\com\nimbusds\oauth2-oidc-sdk\11.18\oauth2-oidc-sdk-11.18.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-codec\commons-codec\1.17.1\commons-codec-1.17.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-io\commons-io\2.17.0\commons-io-2.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\commons-logging\commons-logging\1.3.4\commons-logging-1.3.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-buffer\4.1.115.Final\netty-buffer-4.1.115.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-codec\4.1.115.Final\netty-codec-4.1.115.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-common\4.1.115.Final\netty-common-4.1.115.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-handler\4.1.115.Final\netty-handler-4.1.115.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-resolver\4.1.115.Final\netty-resolver-4.1.115.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-classes-epoll\4.1.115.Final\netty-transport-classes-epoll-4.1.115.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport-native-unix-common\4.1.115.Final\netty-transport-native-unix-common-4.1.115.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\io\netty\netty-transport\4.1.115.Final\netty-transport-4.1.115.Final.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\it\unimi\dsi\fastutil\8.5.15\fastutil-8.5.15.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna-platform\5.15.0\jna-platform-5.15.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\java\dev\jna\jna\5.15.0\jna-5.15.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minidev\accessors-smart\2.5.1\accessors-smart-2.5.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\minidev\json-smart\2.5.1\json-smart-2.5.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\net\sf\jopt-simple\jopt-simple\5.0.4\jopt-simple-5.0.4.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-compress\1.27.1\commons-compress-1.27.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\commons\commons-lang3\3.17.0\commons-lang3-3.17.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpclient\4.5.14\httpclient-4.5.14.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\httpcomponents\httpcore\4.4.16\httpcore-4.4.16.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-api\2.24.1\log4j-api-2.24.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-core\2.24.1\log4j-core-2.24.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\apache\logging\log4j\log4j-slf4j2-impl\2.24.1\log4j-slf4j2-impl-2.24.1.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\jcraft\jorbis\0.0.17\jorbis-0.0.17.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\joml\joml\1.10.8\joml-1.10.8.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-freetype\3.3.3\lwjgl-freetype-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-glfw\3.3.3\lwjgl-glfw-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-jemalloc\3.3.3\lwjgl-jemalloc-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-openal\3.3.3\lwjgl-openal-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-opengl\3.3.3\lwjgl-opengl-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-stb\3.3.3\lwjgl-stb-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl-tinyfd\3.3.3\lwjgl-tinyfd-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows-arm64.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lwjgl\lwjgl\3.3.3\lwjgl-3.3.3-natives-windows-x86.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\lz4\lz4-java\1.8.0\lz4-java-1.8.0.jar;C:\Users\Admin\AppData\Roaming\.minecraft\libraries\org\slf4j\slf4j-api\2.0.16\slf4j-api-2.0.16.jar;C:\Users\Admin\AppData\Roaming\.minecraft\versions\fabric-loader-0.19.3-1.21.4\fabric-loader-0.19.3-1.21.4.jar "-DFabricMcEmu= net.minecraft.client.main.Main " net.fabricmc.loader.impl.launch.knot.KnotClient --username miae --version fabric-loader-0.19.3-1.21.4 --gameDir C:\Users\Admin\AppData\Roaming\.minecraft --assetsDir C:\Users\Admin\AppData\Roaming\.minecraft\assets --assetIndex 19 --uuid fb16e295185231b8b061661a6b10242b --accessToken 20eca50870d54360a360da7f4fc968b8 --clientId 0 --xuid 0 --userType msa --versionType release --width 854 --height 4805⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6156,i,5148016270650365429,12016647367266499358,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7620 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=6044,i,15781913856427514460,14601201633477902354,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7912 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=6124,i,7097901953288587894,2969696142001742013,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=5896,i,12920861965453381482,13822020451995374372,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6340 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=6048,i,8740151134338724599,13968233047264082474,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=6828,i,6879206735119646578,7325946604751134775,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6988 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=6440,i,13090501268982112530,14646157976637999896,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6832 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=5852,i,15548818233436142293,10912869654675857683,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6896 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=7612,i,17196448815585853976,2351251801313211655,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8068 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=3728,i,15695893023195990379,6130539759109102055,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7324 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6440,i,16452144584893104120,10427153853875445507,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7568 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1160,i,834172158951324730,2120489426837141148,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6840 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7796,i,8387895224627310788,15985984803840720368,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=6624,i,2108348533957305971,16825831948166251023,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7768 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7876,i,15061403592813291024,3767601325269174530,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=6640,i,17756997923561056845,4748328894777821454,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=3284,i,14652598211134896726,8114143551619105528,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6548 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,14698034081465841161,6576904888569312070,524288 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=8384,i,14650662737763491902,3447565257996028990,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=8400,i,13077520865086173447,6601261406748958358,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=7792,i,4448914720991582756,14009950701065183292,2097152 --field-trial-handle=2188,i,11016268491218925962,7888739508656770369,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000005
f_000006
f_000008
f_00000a
f_00000b
f_000011
f_000013
f_000016
f_00004c
f_00006d
f_0000b3
f_0000b4
f_0000b6
f_0000db
f_0000df
f_0000e7
f_000119
f_00011a
1e50f36b37f689e4_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
4b6006e64d275b5f_0
the-real-index
index.txt
index.txt
index.txt.tmp
index.txt~RFe6224e8.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
+JXF16842734440432468430.tmp
+JXF3504849739840437002.tmp
+JXF8787873428839619480.tmp
SKL_TempStyleClass10062669555118569147.css
flatlaf-windows-x86_64-8250218117200.dll
_is7z.dll
_isdecmp.dll
javafx-0.jar.sha1
javafx-1.jar
javafx-1.jar.sha1
javafx-2.jar
javafx-2.jar.sha1
javafx-3.jar
javafx-3.jar.sha1
javafx-4.jar
javafx-4.jar.sha1
javafx-5.jar
javafx-5.jar.sha1
jre.zip
is-0XBZJT0N98.tmp
is-AJSDDZ492D.tmp
is-JD1HW3J1D7.tmp
is-P660ELPQVT.tmp
SKlauncher-3.2.18_Setup.tmp
jna8760716136455116848.dll
client-intermediary.jar.tmp
client-intermediary.jar.tmp
launcher_profiles.json
launcher_profiles.json
launcher_profiles.json.tmp.1785842444023
jaxp.properties
logging.properties
jmxremote.access
jmxremote.password.template
management.properties
net.properties
java.policy
java.security
README.txt
default_local.policy
exempt_local.policy
default_local.policy
sound.properties
ADDITIONAL_LICENSE_INFO
ASSEMBLY_EXCEPTION
LICENSE
aes.md
asm.md
c-libutl.md
cldr.md
icu.md
public_suffix.md
siphash.md
unicode.md
wepoll.md
zlib.md
giflib.md
jpeg.md
mesa3d.md
ASSEMBLY_EXCEPTION
bcel.md
dom.md
jcup.md
xalan.md
xerces.md
pkcs11cryptotoken.md
pkcs11wrapper.md
LICENSE
dynalink.md
thaidict.md
ADDITIONAL_LICENSE_INFO
fontconfig.bfc
fontconfig.properties.src
default.jfc
profile.jfc
psfont.properties.ja
psfontj2d.properties
blocked.certs
default.policy
public_suffix_list.dat
tzmappings
javafx-base-22.0.2-win.jar
glfw.dll
jemalloc.dll
lwjgl.dll
lwjgl_tinyfd.dll
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
5d696d521de238c3.customDestinations-ms
SKlauncher.jar
java.dll
javaw.exe
jli.dll
msvcp140.dll
jvm.dll
vcruntime140.dll
vcruntime140_1.dll
jvm.cfg
SKlauncher-3.2.18_Setup.exe
Unconfirmed 663689.crdownload
memory/1116-3332-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3322-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3365-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3299-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3363-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3364-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3362-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3361-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3344-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3348-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3346-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3347-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3320-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3351-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3349-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3345-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3308-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3310-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3331-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3333-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3309-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3307-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3327-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3330-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3321-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3301-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3296-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3302-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3297-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3366-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3319-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3305-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3368-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3303-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3300-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3295-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3294-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3293-0x000002736DB10000-0x000002736DCDE000-memory.dmp
memory/1116-3370-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3176-0x000002736DB10000-0x000002736DCDE000-memory.dmp
memory/1116-3329-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3328-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3326-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3350-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3304-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3373-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3372-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3371-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3298-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3377-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3374-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3323-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3312-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3324-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3306-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/1116-3325-0x00000273130E0000-0x00000273140E0000-memory.dmp
memory/3296-1219-0x0000000000090000-0x0000000000428000-memory.dmp
memory/3296-2568-0x0000000000090000-0x0000000000428000-memory.dmp
memory/3296-2608-0x0000000000090000-0x0000000000428000-memory.dmp
memory/3296-2628-0x0000000000090000-0x0000000000428000-memory.dmp
memory/3296-2634-0x0000000000090000-0x0000000000428000-memory.dmp
memory/4188-1218-0x0000000000830000-0x000000000090D000-memory.dmp
memory/4188-1184-0x0000000000830000-0x000000000090D000-memory.dmp
memory/4188-2643-0x0000000000830000-0x000000000090D000-memory.dmp