Resubmissions
14/10/2026, 00:50
261014-a61gcady2w1014/10/2026, 00:49
261014-a6k2nadx911004/10/2026, 22:55
261004-2wkfxsyfpf1004/10/2026, 22:41
261004-2mejbaszax1003/10/2026, 15:10
261003-sj2p1aszey1027/09/2026, 08:25
260927-ka9egsts4j1027/09/2026, 08:18
260927-j7p7fas16n1026/09/2026, 10:25
260926-mf8fgsdd861026/09/2026, 10:13
260926-l851ds1djg1024/09/2026, 12:57
260924-p6wkqathrd10Analysis
- user interaction
yes - max time kernel
519s - max time network
640s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
18/08/2026, 04:30
General
- Target 4363463463464363463463463.exe
- Size 10KB
- Sample260818-e44hfaej5y
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Malware Config
Extracted
-
formbook
-
3.9
-
xx
-
avricotprint.com
-
wiregalvanize.com
-
reapii.info
-
sungkhong.com
-
samakayadtb.com
-
zerofuchs.com
-
taxopark.biz
-
eatinginbangkok.com
-
cooleju.com
-
zensane.net
-
enviraogs.com
-
1stcentral-email.com
-
zylphyr.com
-
1zg0xq.info
-
buyercard.net
-
moom-intl.com
-
wcjcfj.com
-
boutiquevivace.com
-
zgluntai.com
-
bkddpec.com
Signatures
- Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 2 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Downloads MZ/PE file 2 IoCs
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 26 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 4 IoCs
- Drops file in Windows directory 1 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 8 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: MapViewOfSection 57 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 27 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"2⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\order_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Files\order_pdf.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /02⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds policy Run key to start application
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Files\order_pdf.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0x78,0x114,0x7ffa00acc728,0x7ffa00acc734,0x7ffa00acc7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1732,i,13791735512134490482,13028192892830597236,262144 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1792 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1432,i,15583207410594394756,17360528320502916555,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,12995664308704462535,16856634880793800921,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2388 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,313036544074050073,4941503760761552843,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3548,i,2830385315273364353,1820147951209102120,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3556 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4440,i,10259873041278045634,478655101001205341,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,1517074498840815592,9512139569795014555,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4644 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5556,i,8195276331567523622,799894803176812398,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5804,i,1975657206444575289,582755291913996429,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4876,i,2417591339577821872,14244395123349015790,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5968 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3348,i,6148301135991515411,7614882797412832915,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3368 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4756,i,12715044130366198681,8478184883817012809,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3988,i,15515310480286453110,9917205689467023414,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3680 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,6459375630963733791,14582411110913639345,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4548,i,8995944678602460232,306713876546556176,262144 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3300 /prefetch:103⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,6899672587676587236,18000524837362264973,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3604 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3340,i,14139998508244495630,12316741294154993347,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4616 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6156,i,3592295016456069206,12002364194180191418,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6200 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6404,i,16788489124448291988,2912561981316467444,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6348 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4796,i,4716220318466476919,5511185194154327799,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4468,i,10487156993229296672,128532190593691527,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6528 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6524,i,11345862080899532205,14216425035828728155,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6040 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6356,i,3838970510457504239,4473622538682555532,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6560 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6412,i,16162809602200340796,13410829001805197217,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6384,i,8895129064318841255,17827483161242220668,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6784 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5928,i,9285705800868059806,901918351314457613,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6516 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6804,i,12260638937110240374,6602544754376842807,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6868 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4872,i,11726758742576456785,18077905235597711079,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6896,i,11580406840230286941,784650522856800365,2097152 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5948 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6748,i,17115682826275631882,14598271869370337177,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6756 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5952,i,16558951534281723542,10462317200336720113,524288 --field-trial-handle=1976,i,1930936907695728452,17440116798383808407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:113⤵
- System Time Discovery
-
-
-
C:\Program Files (x86)\R4h9l_r\ubculs.exe"C:\Program Files (x86)\R4h9l_r\ubculs.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Gathers network information
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap21258:90:7zEvent242892⤵
-
-
C:\Users\Admin\Desktop\IDA-Pro-7.7-main\ida64.exe"C:\Users\Admin\Desktop\IDA-Pro-7.7-main\ida64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\dnSpy.exe"C:\Users\Admin\Desktop\dnSpy.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1984 -prefsLen 27097 -prefMapHandle 1988 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {0b1eb79f-80fe-4614-aebe-eb38e0374bee} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27133 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2444 -initialChannelId {bf3295c8-10a5-444b-9b7f-d3cbfec1b991} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3816 -prefsLen 27274 -prefMapHandle 3820 -prefMapSize 270279 -jsInitHandle 3824 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3832 -initialChannelId {03a509f9-928c-4fa6-adfb-6e32d4b130b5} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3988 -prefsLen 27274 -prefMapHandle 3992 -prefMapSize 270279 -ipcHandle 4008 -initialChannelId {07714855-51a9-41c4-979b-c681e33548c6} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34773 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4384 -initialChannelId {dd460526-718d-4076-8f4b-60143a30f5c7} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4948 -prefsLen 34982 -prefMapHandle 4952 -prefMapSize 270279 -ipcHandle 4960 -initialChannelId {0b6981bb-9de6-45ef-a60d-8fa07ab6acba} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5100 -prefsLen 32872 -prefMapHandle 5104 -prefMapSize 270279 -jsInitHandle 5108 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5116 -initialChannelId {a1704f6f-6857-4131-a9c6-98813fde2d4a} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32872 -prefMapHandle 5216 -prefMapSize 270279 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {5f8d94da-f5b4-417d-9daa-b9018dbd434e} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5588 -prefsLen 32924 -prefMapHandle 5592 -prefMapSize 270279 -jsInitHandle 5596 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5604 -initialChannelId {629cf4ca-f2a5-4f4e-b525-f0c99583d980} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2736 -prefsLen 33031 -prefMapHandle 3288 -prefMapSize 270279 -jsInitHandle 3504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6128 -initialChannelId {39a3f486-ffdc-4ec6-8a3c-f7503021c760} -parentPid 3252 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3252" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\App.cmd" "2⤵
- Executes a command shell one-liner
-
C:\Users\Admin\Desktop\jit.exejit.exe bcjit.ico3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc daily /st 10:19 /f /tn CloudDrive_ODM5 /tr ""C:\Users\Admin\AppData\Local\ODM5\ODM5.exe" "C:\Users\Admin\AppData\Local\ODM5\bcjit.ico""4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc daily /st 10:19 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\Desktop\jit.exe"C:\Users\Admin\Desktop\jit.exe" "C:\Users\Admin\AppData\Local\Temp\dist.lua"4⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc daily /st 10:14 /f /tn CCleanerSkipUAC_7d7752 /tr ""C:\Users\Admin\AppData\Local\7d7752\7d7752.exe" "C:\Users\Admin\AppData\Local\7d7752\dist.lua""5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc daily /st 10:14 /f /tn Setup /tr "C:/Windows/System32/oobe/Setup.exe" /rl highest5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Programs\Chromium\Application\Chromium.exe"C:\Users\Admin\AppData\Roaming\..\Local\Programs\Chromium\Application\Chromium.exe" "NTE3YjdjNWU1NjYzNjU2YTA1N2Y="5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"6⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"6⤵
-
-
-
C:\Users\Admin\Desktop\jit.exe"C:\Users\Admin\Desktop\jit.exe" "C:\Users\Admin\AppData\Local\Temp\dist.lua"5⤵
-
-
-
-
-
C:\Users\Admin\Desktop\IDA-Pro-7.7-main\ida64.exe"C:\Users\Admin\Desktop\IDA-Pro-7.7-main\ida64.exe"2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C01⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\System32\oobe\Setup.exeC:/Windows/System32/oobe/Setup.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\Setup\Scripts\ErrorHandler.cmd2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\ODM5\ODM5.exe" "C:\Users\Admin\AppData\Local\ODM5\bcjit.ico""3⤵
- Executes a command shell one-liner
-
C:\Users\Admin\AppData\Local\ODM5\ODM5.exe"C:\Users\Admin\AppData\Local\ODM5\ODM5.exe" "C:\Users\Admin\AppData\Local\ODM5\bcjit.ico"4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\ODM5\ODM5.exeC:\Users\Admin\AppData\Local\ODM5\ODM5.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\7d7752\7d7752.exeC:\Users\Admin\AppData\Local\7d7752\7d7752.exe1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004C01⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
lua51.dll
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_000005
f_000027
f_00002d
the-real-index
the-real-index
MANIFEST-000001
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5943c6.TMP
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
DB1
order_pdf.exe
tmpaddon
tmpaddon
LK2logim.jpeg
LK2logrc.ini
LK2logrg.ini
LK2logri.ini
LK2logrv.ini
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
05aeb46d-b1a3-422b-aa38-404450c80f5f
1a9ba75c-a426-4105-b788-93ae0a9d7ea7
1d41aaff-4ec1-4747-9d04-76e2601f1105
54ae562e-6278-462d-9783-be379138e3ad
e3cd7514-56ac-48de-a010-5c5952472c57
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs.js
prefs.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.baklz4
3870112724rsegmnoittet-es.sqlite
App.cmd
IDA-Pro-7.7-main.zip - Shortcut.lnk
IDA_InitTool.exe
Qt5Core.dll
Qt5Gui.dll
Qt5PrintSupport.dll
Qt5Widgets.dll
idagui.cfg
ida.exe
ida.hlp
ida.ico
ida.key
ida64.dll
ida64.exe
idapyswitch.exe
idat.exe
idc.idc
qwindows.dll
arm_mac_stub64.dll
armlinux_stub64.dll
idapython3_64.dll
plugins.cfg
qwindowsvistastyle.dll
INSTALLER
WHEEL
__about__.py
__init__.py
_manylinux.py
_musllinux.py
_structures.py
specifiers.py
tags.py
utils.py
version.py
WHEEL
pip.exe
__init__.py
sip.pyi
qt.conf
theme.css
theme.css
bcjit.ico
api-ms-win-core-console-l1-1-0.dll:Zone.Identifier
dnSpy.runtimeconfig.json
dnSpy.Console.exe
dnSpy.exe
jit.exe
jit.exe:Zone.Identifier
IDA-Pro-7.7-main.zip:Zone.Identifier
content-plugin-claude-cowork-v1.haAX6CuA.1-beta.1.zip.part
optimizer-prompt-opus-claude-1.2iRrhj7q.6.zip.part
memory/1168-512-0x0000000000DE0000-0x0000000000DEB000-memory.dmp
memory/1388-28-0x0000000000410000-0x000000000041E000-memory.dmp
memory/1388-26-0x0000000000410000-0x000000000041E000-memory.dmp
memory/2152-29-0x0000000000400000-0x0000000000500000-memory.dmp
memory/2152-24-0x0000000000400000-0x0000000000500000-memory.dmp
memory/2152-25-0x0000000000400000-0x0000000000500000-memory.dmp
memory/2152-23-0x0000000000400000-0x0000000000500000-memory.dmp
memory/3232-31-0x00000000141B0000-0x0000000014326000-memory.dmp
memory/3232-510-0x00000000141B0000-0x0000000014326000-memory.dmp
memory/3992-503-0x0000000000400000-0x0000000000500000-memory.dmp
memory/3992-505-0x0000000000400000-0x0000000000500000-memory.dmp
memory/3992-504-0x0000000000400000-0x0000000000500000-memory.dmp
memory/3992-519-0x0000000000400000-0x0000000000500000-memory.dmp
memory/4600-14598-0x00007FFA02110000-0x00007FFA02137000-memory.dmp
memory/4600-14590-0x00007FFA02110000-0x00007FFA02137000-memory.dmp
memory/4600-14564-0x00007FF9E0080000-0x00007FF9E00A7000-memory.dmp
memory/5116-0-0x0000000000540000-0x0000000000548000-memory.dmp
memory/5116-1-0x0000000004FB0000-0x000000000504C000-memory.dmp
memory/5116-2-0x0000000005210000-0x0000000005220000-memory.dmp
memory/5572-7562-0x00007FFA016D0000-0x00007FFA01C26000-memory.dmp
memory/5572-7584-0x0000026EFC650000-0x0000026EFC686000-memory.dmp
memory/5572-7613-0x00007FFA1A970000-0x00007FFA1A997000-memory.dmp
memory/5572-7610-0x0000026E816B0000-0x0000026E816E6000-memory.dmp
memory/5572-7605-0x0000026E816B0000-0x0000026E816DE000-memory.dmp
memory/5572-7588-0x00007FFA016A0000-0x00007FFA016C7000-memory.dmp
memory/5572-7586-0x00007FFA016A0000-0x00007FFA016C7000-memory.dmp
memory/5572-7561-0x00007FF6633C0000-0x00007FF6637BF000-memory.dmp
memory/5572-7582-0x0000026EFC650000-0x0000026EFC67E000-memory.dmp
memory/5864-5-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-15-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-14-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-13-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-11-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-9-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-12-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-3-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-10-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/5864-4-0x0000027DAA230000-0x0000027DAA231000-memory.dmp
memory/6740-13676-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13669-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13668-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13667-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13666-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13665-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13664-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13663-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13662-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13661-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13660-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13659-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13658-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13657-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13656-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13655-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13654-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13653-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13652-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13651-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13650-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13649-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13648-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13647-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13645-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13644-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13643-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13642-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13641-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13640-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13670-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13671-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13672-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13673-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13674-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13675-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13677-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13678-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp
memory/6740-13646-0x00007FFA0E4E0000-0x00007FFA0E4F0000-memory.dmp