Analysis
- user interaction
yes - max time kernel
899s - max time network
902s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/08/2026, 16:48
General
- Target Stumble Guys.exe
- Size 289KB
- Sample260820-vbftns1eld
- SHA256 05621cd21a6be168d59ea42d8d58b455b92fcd36285c0b10ef8d002b568cf70c
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 14 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 51 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Drops file in Windows directory 16 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies data under HKEY_USERS 13 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 25 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 28 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stumble Guys.exe"C:\Users\Admin\AppData\Local\Temp\Stumble Guys.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9dcd9c728,0x7ff9dcd9c734,0x7ff9dcd9c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,14059352327088887246,9834184225976908519,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,3896246284843590742,7653928507798135837,262144 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2092 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2408,i,5109112466052130798,18230873875431457893,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2576 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3128,i,345731632820091024,3385651384019991607,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3172,i,6415931585671755834,18117837681342030641,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,2366712589674868193,11529460008024833103,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4688,i,9739250564069267261,8586047997721265975,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,4437631771718967742,14207602951543917744,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5408 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5552,i,12429415730179445182,12054947560403029169,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3288,i,465796708828155367,3850598765926499252,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3332 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=1676,i,14352364617976704927,2213223245769109586,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,11918546103489926990,18087369385311023654,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3416 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6000,i,12224462164420963687,17771545290734821370,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6008 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,17657864388580008430,3246072568873388882,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6420 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6456,i,6546512899322800222,2260933385307031058,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6336 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6356,i,892406768292145147,15219067413386293617,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6380 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6652,i,1430288564172215157,4670119902963994828,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6872,i,16033681697061609409,18271070497921908157,262144 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6724 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6792,i,16150211987461685426,3277986251737122638,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5176 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6980,i,15448003108817336780,12004688683928638576,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7108 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6696,i,13940856262692147172,17591927493083218259,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4632 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=868,i,10427311786651805148,17661610472057463131,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5996,i,14855559490090842569,14603947456663630511,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6176 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7116,i,18198234590706287561,1822827573821683618,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7300 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7476,i,12622346458043527501,13180721325075920733,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7628,i,10851894944682217843,13632289966231924426,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6272,i,4559497328137555281,64609413992354404,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7672 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7832,i,5399090076947350026,4642004063476277408,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7664 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7964,i,14557550239322488977,8386270632116926611,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7952 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8144,i,13864666781818177765,11116510208649880392,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8136 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7984,i,13285748878184551612,12276744464746912422,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7976 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7624,i,12708493648944861669,14236079067278639136,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7888 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7868,i,2788521075514562381,130248784241814838,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8432 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8568,i,15406232768216885556,4338571765533100511,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8580 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=8756,i,2325287407578222475,1050150333417502974,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8328 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8536,i,3959396005276372946,17720105574522198935,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8592 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=8664,i,11360448337404895747,13179740414818902633,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=8556,i,6938591232334943381,8757194386259259105,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7980 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7100,i,7326280616669798256,11206539853518393374,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7000 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7152,i,7825783851943502342,16042722549389567309,2097152 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=8308 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=8660,i,15091648489656130809,446431318860139247,524288 --field-trial-handle=2088,i,2726258090094857377,5479308857860146845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7556 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\VC_redist.x64.exe"C:\Users\Admin\Downloads\VC_redist.x64.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{B604C763-7BBE-4DFB-A45A-44D297C92547}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{B604C763-7BBE-4DFB-A45A-44D297C92547}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\VC_redist.x64.exe" -burn.filehandle.attached=716 -burn.filehandle.self=7202⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\Temp\{B3FE92FC-60FC-44DE-8E5B-83159053D8EA}\.be\VC_redist.x64.exe"C:\Windows\Temp\{B3FE92FC-60FC-44DE-8E5B-83159053D8EA}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E655A985-9AF5-4308-993A-08F33107B4BD} {CE5D7B4B-B650-47C9-962E-9F00613C51E1} 37043⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{EDDDCF75-0F05-4B26-865D-2B21D630EE9B} {E5CF5B98-DB44-4512-A2D7-DB0A044179C5} 52044⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{EDDDCF75-0F05-4B26-865D-2B21D630EE9B} {E5CF5B98-DB44-4512-A2D7-DB0A044179C5} 52045⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{6DE64148-C609-471F-8E77-F140D0CE6DBC} {958F8AEA-2753-4015-87D5-191B65AC1D8E} 55966⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260820175813.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260820175813.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{15A36C1F-792E-4B52-B31E-049D812F2A57} {FC6D0DD6-AAD7-4038-B478-CCBAF37B56DC} 59244⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\Stumble Guys.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\Stumble Guys.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe" --attach 3728 31322087792642⤵
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe" "3728" "3132208779264"3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2fc 0x4f81⤵
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\Stumble Guys.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\Stumble Guys.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe" --attach 888 21440218439682⤵
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe" "888" "2144021843968"3⤵
-
-
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\Stumble Guys.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\Stumble Guys.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe" --attach 5176 23279572787202⤵
-
C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe"C:\Users\Admin\Downloads\Stumble Guys (v0.73)\Stumble Guys (v0.73)\UnityCrashHandler64.exe" "5176" "2327957278720"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
e5f874f.rbs
e5f875b.rbs
e5f8762.rbs
e5f8771.rbs
e5f8775.rbs
state.rsm
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_00004e
f_0000c0
546a36b93e546c04_0
ba67dd153addee9f_0
ff9b3bd273347b2b_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index
the-real-index
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt~RFe58cc05.TMP
the-real-index
the-real-index~RFe58d443.TMP
the-real-index
the-real-index
index.txt
index.txt~RFe59455c.TMP
the-real-index
the-real-index~RFe5db912.TMP
index.txt
index.txt~RFe5d5130.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
MSIfb04e.LOG
dd_vcredist_amd64_20260820175813_000_vcRuntimeMinimum_x64.log
dd_vcredist_amd64_20260820175813_001_vcRuntimeAdditional_x64.log
default.exc
Unconfirmed 727487.crdownload
license.rtf
thm.wxl
thm.xml
wixstdba.dll
logo.png
wixstdba.dll
cab2C04DDC374BD96EB5C8EB8208F2C7C92
cab5046A8AB272BF37297BB7928664C9503
vcRuntimeAdditional_x64
vcRuntimeMinimum_x64
VC_redist.x64.exe
memory/888-3512-0x000001F311680000-0x000001F311690000-memory.dmp
memory/3728-3468-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3474-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3441-0x00007FF974D90000-0x00007FF974DA0000-memory.dmp
memory/3728-3442-0x00007FF974D50000-0x00007FF974D60000-memory.dmp
memory/3728-3443-0x00007FF974D50000-0x00007FF974D60000-memory.dmp
memory/3728-3444-0x00007FF974D50000-0x00007FF974D60000-memory.dmp
memory/3728-3445-0x00007FF974D50000-0x00007FF974D60000-memory.dmp
memory/3728-3446-0x00007FF974D50000-0x00007FF974D60000-memory.dmp
memory/3728-3448-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3450-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3451-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3452-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3454-0x00007FF977560000-0x00007FF977570000-memory.dmp
memory/3728-3456-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3458-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3457-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3459-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3460-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3461-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3462-0x00007FF977560000-0x00007FF977570000-memory.dmp
memory/3728-3463-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3466-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3465-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3464-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3467-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3416-0x00007FF974D50000-0x00007FF974D60000-memory.dmp
memory/3728-3469-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3470-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3471-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3472-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3473-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3415-0x00007FF974D50000-0x00007FF974D60000-memory.dmp
memory/3728-3475-0x00007FF977560000-0x00007FF977570000-memory.dmp
memory/3728-3476-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3477-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3478-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3479-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3480-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3481-0x00007FF977430000-0x00007FF977440000-memory.dmp
memory/3728-3482-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3483-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3484-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3486-0x00007FF9783E0000-0x00007FF9783F0000-memory.dmp
memory/3728-3487-0x00007FF9783E0000-0x00007FF9783F0000-memory.dmp
memory/3728-3488-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3489-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3490-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3491-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3492-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3493-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3494-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3495-0x00007FF977FE0000-0x00007FF977FF0000-memory.dmp
memory/3728-3496-0x00007FF977560000-0x00007FF977570000-memory.dmp
memory/3728-3497-0x00007FF977560000-0x00007FF977570000-memory.dmp
memory/3728-3498-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3499-0x00007FF9783E0000-0x00007FF9783F0000-memory.dmp
memory/3728-3500-0x00007FF977560000-0x00007FF977570000-memory.dmp
memory/3728-3501-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3502-0x00007FF9773E0000-0x00007FF9773F0000-memory.dmp
memory/3728-3351-0x000002D946300000-0x000002D946310000-memory.dmp
memory/4960-3314-0x0000000000BC0000-0x0000000000C37000-memory.dmp
memory/5292-3311-0x0000000000BC0000-0x0000000000C37000-memory.dmp
memory/5596-3313-0x0000000000BC0000-0x0000000000C37000-memory.dmp