be34cd0fd7803d730e5935cbdd5ced083ae992882464db0bc7726a1eb394c94b

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/09/2026, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BBVA 10092026.js
Size 798KB
Sample260911-gd4rmastdy
SHA256 be34cd0fd7803d730e5935cbdd5ced083ae992882464db0bc7726a1eb394c94b
MD5 5d4c88d1f27e232b6328829f610b639f
SHA1 5da85c506b40618eca0411794154fef76e98f91d
SHA512 2034a40a2e1e86c0b057eaa92b89a51b5b68f13c345f02d08455a596a0cedba09769ab0f9fad9904f34681846972d855ef369720ed584edbfb39ce4851d43dfa
SSDEEP 192:emJtJE0sku3flBbKmXcnOu1zeOt1fyn/hqpOPy90ap30QYJSfh8p3Mfc0cD0Cenh:/
TLSH
T12F051D7682BD2F2EC46B5659CEBA3C0C5CF054A2074EF479ED3BA4C4E47CBD966A0190
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection discovery execution spyware stealer

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1496	wscript.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1496	wscript.exe

Executes dropped EXE 1 IoCs

pid	Process
4972	b3ba.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 33 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	b3ba.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b3ba.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook	b3ba.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key opened	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook	b3ba.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4960	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
2592	chrome.exe
4972	b3ba.exe
4972	b3ba.exe
2592	chrome.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe
4972	b3ba.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4972	b3ba.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeDebugPrivilege	2592	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 4972	1496	wscript.exe	90
PID 4972 wrote to memory of 2880	4972	b3ba.exe	92
PID 2880 wrote to memory of 2592	2880	chrome.exe	93
PID 2880 wrote to memory of 2392	2880	chrome.exe	94
PID 2880 wrote to memory of 4960	2880	chrome.exe	95
PID 2880 wrote to memory of 408	2880	chrome.exe	96
PID 2880 wrote to memory of 3156	2880	chrome.exe	97
PID 2880 wrote to memory of 2736	2880	chrome.exe	98
PID 2880 wrote to memory of 4500	2880	chrome.exe	99
PID 2880 wrote to memory of 832	2880	chrome.exe	100
PID 2880 wrote to memory of 1124	2880	chrome.exe	101
PID 2880 wrote to memory of 4440	2880	chrome.exe	102
PID 2880 wrote to memory of 1912	2880	chrome.exe	103
PID 4972 wrote to memory of 1912	4972	b3ba.exe	103
PID 4972 wrote to memory of 1912	4972	b3ba.exe	103
PID 4972 wrote to memory of 2592	4972	b3ba.exe	93
PID 4972 wrote to memory of 2592	4972	b3ba.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b3ba.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\BBVA 10092026.js"
1⤵
- Badlisted process makes network request
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\b3ba.exe
  "C:\Users\Admin\AppData\Local\Temp\b3ba.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffd158ec728,0x7ffd158ec734,0x7ffd158ec740
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1608,i,5000220944618428113,8239403012264018678,262144 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
      4⤵
      PID:2392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --force-high-res-timeticks=disabled --metrics-shmem-handle=1956,i,10719086973110551636,6324991302360551142,524288 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:11
      4⤵
      System Time Discovery
      PID:4960
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,15580304086816242389,255878733723590091,524288 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:13
      4⤵
      PID:408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2956,i,8469445097058368947,2145091859928350672,2097152 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
      4⤵
      PID:3156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2960,i,6431520767391600008,11246189598406829102,2097152 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=2952 /prefetch:1
      4⤵
      PID:2736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3160,i,2452001836222463524,18245546009323633078,2097152 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:1
      4⤵
      PID:4500
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3188,i,12562923020640666161,397881098062857962,2097152 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:9
      4⤵
      PID:832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4060,i,7391964620919904262,7363070140574934759,2097152 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:9
      4⤵
      PID:1124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4232,i,14517889614506419441,11518171734072968184,2097152 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:4440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc" --force-high-res-timeticks=disabled --metrics-shmem-handle=4316,i,4106546429538985523,3626758584457886883,524288 --field-trial-handle=1860,i,15319826306589641643,16190753258079060026,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:1912

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b3ba.exe

Path C:\Users\Admin\AppData\Local\Temp\b3ba.exe
Size 4.2MB
SHA256 0744f2c90f5922e0c2c520e0bf0d87f8904097f698e770cc6d57ed1fd1af8edf
MD5 f95ef69a09222c907eefce785f3e6599
SHA1 bd61d9c460ea564cede0173fedd2885d149d64f8
SHA512 bd3095390cdba28972835de7d33b79da3673189288be3d71f0117e4425b7396deb30c363c032bd72d5414af6ca993b9a17d92e5cb7a629bf10bd0952cec03f4d
SSDEEP 98304:V+vhTbEABMJXR3CaGyt8KxogRDtvljg2:V+pvBMf3CaXlRBlM2
TLSH
T1EE26D05261C4A9D9F39EFA754310F52F8521EAA3EF31B48ABB5F2E49C8348518D34E07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xh_om_mark.bin

Path C:\Users\Admin\AppData\Local\Temp\xh_om_mark.bin
Size 40B
SHA256 d97951abbd80043b3ed27fa57d7effb6f86912bef26f041153f5794535321047
MD5 ddee33f6052c4f9fb6f9c836d9ed4990
SHA1 7b3916fff7b188581fc4e9c67e9acde3400b0ddb
SHA512 5d3481d9fbe00e3b4e65e6d31a98bb509cd425a687ce0372c28d8cb002a6718edc3a93e0dfd366409bead5369d8c3290f508d58c9c5500eb20ecbb599cbe0d30
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Crashpad\settings.dat
Size 40B
SHA256 1c46a6da264e61ac1d441df3adfa046e0f278d6adde49d79ad1c96a87a7ca8c2
MD5 8aca0f4e2b85f4bc2eb26c86b7120176
SHA1 b532b113c4ec6fc0de63b32553586739580d3bf0
SHA512 db3a7d178bfd6f9af564f7a875b957c11590260108b3a19dca1db79a00485ab874c821a2b28a16ebadf684727aff7012a9b2a0c9b9377cddfb438d43dae67911
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 7ff6499e3cf1b9e07f53e2fe969d12b3d4548fc8b1384d0bf06f547a243d0e52
MD5 e4b010e0f54c5be06b83102df25f53d4
SHA1 382e611f76f36451790252fcc5544adfb84f3eed
SHA512 5e7a0caeef10605798030256d860b3a25b87afe70dcdbb0e436adc7500e6c5a1ac557e6b068fcf300bce3950f4fd93470413c8a1a12e66fbeebe6d70254b0cdc
SSDEEP 3:MsFlthltlluewwtlUkflryFKlHel/l11Vb5DUcKB7avS5NFIMhMhl+C+fl0zxM:/F8eHtlUkNGFKlHel/lkB7zFO+C+WzG
TLSH
T1A3138CBFC0D41C09C5C0203CB083A7B083A0AC80E08202033060F422F488F0F181C410
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 af49751c9fb5e42defd619cdc3d2e651f2ca567660e338a50be36e5212315ad4
MD5 1c59bef2548f0001670ad3a9408d8614
SHA1 e46b6f62a74ecabece04465c22211ec246d18713
SHA512 b92539a32e7ed2634b2acf058d707db36f28c6b756dca2d6d9b1386b229257ee3017752f084ca19b84962d9ba1a0abda3ebd9ccf35a5cb616d7baca76e229557
SSDEEP 24:26flkBph8WYGm8sbCmkf2lk3z/mizblQZ:nfloY4s2P3zlblQ
TLSH
T1284488EB7840421BDB54A3F90100233C9E3691096DEBDDDFF56814F25484FAA66A85E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 22d15afc03860990d5060869be7ed8e3715e05a73912a8c96deed38feadbeadf
MD5 609a010b570fc1bca5e0e183c6fd8b48
SHA1 47d9e3d7b8a9c771ad0a533fc0aa6a27eb90ad1e
SHA512 bfd86d5cece638568aa47d67717f83dbbdac13181061a5b6910e816b68cd3533d4dfa7c9d298ef3072d7a7c2c72b042fe58687f3b259c9b6b20baf9318eb7fa9
SSDEEP 768:9UfDPLSgcRUv+m4CUfDPLSgcRUv+B42eKUfDPLSgcRUv+848fDPLSgcRUv+w4:ejPe3b
TLSH
T127161BF60F287946D7C6EBB0ABC9DE183D711298E8D31C92F13292695AE1FC50BC125D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Cache\Cache_Data\f_000001
Size 38KB
SHA256 fcb8b3819ea4586a2123df5b5b135fa6e0d9796035e4dfa13d0c0e88f19dff1b
MD5 688a0e3555cd4f5b2fac53a22a65a9a8
SHA1 f222b9f639447e39fb1b36495ec130e18bd500f7
SHA512 ca6a66b66a507242b0753cf567dcab87c07e5bf203d77ece03a88b9d2ad2c250d7719f41d50014e1ec142c9790f1e5029e4230184d9fb244b5d7595b691ed646
SSDEEP 768:b5OQmrEGTqADKOt1mrYOqQdEUFpuSx4lAsPt52D/e6q+QPEliAfFyAwxM:tOQm4KBfrOqQHFpuSqqsPHshc8liAf0o
TLSH
T1D103E1DFF754591FE8091952AF55F2ADCC1B42DE5A200F26B762F11E93C572B066803C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Cache\Cache_Data\index
Size 256KB
SHA256 f79a0d6a12199e9044a8d8200fa452a74387a4ee844494a12d85936dcc1501bc
MD5 55c2b5f697ae7ac7fb65c17d6a90b807
SHA1 f41ad8a346dea13a66d2adaaa443a26a42afef9e
SHA512 67ddfe59bec096207bb0ec15fab917117b995fe03b39a42a0cdc0a9b20797a39fb8374782acd97fed6edd323b1c08c2cc3f97933bcbd401e212a18f30bcf8440
SSDEEP 3:LsYllfltlNllklkXloPAXbll8njNtlmNtlwlNlXl:Lso13lPoPAkkN
TLSH
T11344023FD3E54C05C5D0057CC41783615738D408D50FD3570B0859203CC57D24E1D4E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 52d3a91b15bba1704b24f044b44640bc4952a240def74bed12412358af214e37
MD5 aa218ca95df7195bfc9493a71a13fe00
SHA1 4fc483db1088edda34f25446862f4e5c214d658e
SHA512 7c30729bfab4c1c50da8bcda2d2ec5a78702e492afb5e2a5ee6660d9f0110a8346ec42e3ce7a37c3629f8a208ba38fa8c0ab01f6c28bd0dd80639bece6ea9bc2
TLSH
T1B4E02B81829C0F1DD33DB6F7CDA603088A0A52C42ABE7603A880C2C23352468124C123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 56f65345ddf52f8532d05669d5fc336e115e886184dc837d68556e1be4a18f66
MD5 6298a88ebe145f27d136794ac5c52e6a
SHA1 7194bb81151e318da939019c541f7d9182531e33
SHA512 82a67718adff47de66010cf55b192f05b47a88dbc6deca111959080e0e55634b934050db2bd50b3a4f9fef71108201effb92321a4c3963df1e22bec6d744c156
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 36317e111dc7d4b9b3ba8e67b7583dacd48ae85fe9d7b90719196d6d39ffa601
MD5 e53e7b2eea42e0f287a8fe8b252f8de1
SHA1 df3306b437633041cca621c19c7194ab6e7fd43e
SHA512 261dcb8b5e103b5fdd25e30761d9c6a47671823a344e72cc3ae862907c641c1b0372a9ba757b49a5318e6760f4688ed324644671b576dc0b5a3c1ddc03766fd0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\DawnGraphiteCache\index
Size 256KB
SHA256 d5c8bbe381443ea3dc1735a40f3f18d1b82eb42ddec7f9c61b2430a3ff40abd5
MD5 8e308600983b7a92de4b719b76432790
SHA1 e188f57f43ea4117550609817e7049b6018757c8
SHA512 24e56abc67ac1b432dd2bf590f302876f3a9afcf458a93683e507d898366494dae43ae4605541b41d94c21442165840ccb577090a95c2b86a4fdc74a95fd916a
SSDEEP 3:LstlNllklkXlnwllll:LsX3lPnwtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\DawnWebGPUCache\index
Size 256KB
SHA256 bae8245adf38bef327b0b2987b29a1dd858f175a7051d21ce11695b1509f1163
MD5 08e87c167c1528a82abeb18954292b70
SHA1 f6877dc80becb3b6935b1485ebc1e7e32d441d6b
SHA512 c0865598df6b92af05c0396f2c24fc542c72c3d23c7cea81de340573b3bfff0fc3bdca0d8fceb88edac0948a0f5e3671671527b8f0f81452490f365fb77ee9a6
SSDEEP 3:LstlNllklkXliBUcK/ll:LsX3lPi27tl
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\GPUCache\index
Size 256KB
SHA256 f38f0572722648aca77b0ae6900e53d6ef0dfb968ed5e439eb3368b4cc6408ce
MD5 4b87e27f88ad39921b971f7fdd9b6a80
SHA1 c21d9f250bf82fc6a313a5ce04e5d7dc9babfabf
SHA512 d13630d9e6394fba3868e409929a08fdf74a6e90459d6ff16671dd683723f413936ba64b681767fc6b99e5d5ff3f133b4ad3eedef36e6b0063bf0b58afa198ae
SSDEEP 3:LstlNllklkXluh7tl:LsX3lPuh7tl
MD5 SHA1 SHA512 SSDEEP

Submit Download

README

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\README
Size 180B
SHA256 c43668eec4a8d88a5b3a06a84f8846853fe33e54293c2db56899a5a5dfb4d944
MD5 883d62acd72005f3ad7a14500d482033
SHA1 e5900fe43fb18083bf6a483b926b9888f29ca018
SHA512 97bb1bde74057761788436de519765ea4e6ba1ad3a02d082704e8b3efca3ef69d3db6e65b65e5f5f90205e72c164d82779cf754d52ec05d944df49f10d822a6d
TLSH
T13CC01222958335AD511A81B2690162824A128831E42E9A61A6DE844C1704A63A2507DB
MD5 SHA1 SHA512 TLSH

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 472B
SHA256 7433e2de592bac3d53e34206cd580d140d107eae0defa146b238d209d3b34c87
MD5 d1d6b5a71725264ad4893180b3baa615
SHA1 d1c1cef579f3a8b1d517c2171d6aa37390634fc3
SHA512 6f50f6f08b9c5fc7fdb614ee423f14cf2b2407c2488d7b5a0cfe8a497174ae194d4f564bda132d3180963213e24fa8bb6b25c158a5ac8734d2a73bc87f2068a1
TLSH
T1C2F0A3560D498974D71845F2CBD7735D87172628D93E5255B954821CD494F6CC8909C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 878cbf4b87fd1d018149af6263f9cf8dc138c9c339517a5f1b6607d5877c9541
MD5 549a925ef48bfd67fee8eb0c20391703
SHA1 293ebeeb5ef902ecd416d39b313b5a365441a73d
SHA512 f0ecd7cbdc360592221df0f8e95eadb68e4c7861dab454822ea263f5b701fdb986667796e287818de74ccba3fbc6b93d974d63d9c89d6604eec84c53e5c8957a
TLSH
T110A0021902489164C14112B07D0583881604B9258000021777E04346CEA10E14A91245
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 b3a761f4bed5602d6343b62cd3a413dc954b50ded61c6b06a8511ca17e4cdb5b
MD5 6cc2bbab79f882492f426ad3578b2d38
SHA1 2744617b4d6a02907a1a6f7c45fd8c13c16b410b
SHA512 029938a986fcbf1636e2ea1db6dc8d624a2298a11b25049a70752bf69fe671c864e95295582c47eb1febf5e4bec792a7b5f4035e306b3bdd5e1bb6a9e2d21df7
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\GrShaderCache\index
Size 256KB
SHA256 473bdc4530d6ab75aa0b33e31aca827fe3007dd75a9b67606b608d014a37d0c0
MD5 5067dbfca2efb033945a0174775c9867
SHA1 f6ba883c22390b9cd6d28312e52d2577fc14de5f
SHA512 dff5a596a75328a5d20619a181f89942310e7420a1f7b01f190c1f2fa7fdd6bad3cea47d04ef11f46caa44fb11980e72740c4407046ce5a375ca4153c45c9801
SSDEEP 3:LstlNllklkXl/ll:LsX3lPtl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\GraphiteDawnCache\index
Size 256KB
SHA256 c4bcdfc5202d0d138482b3d7addc8a1cc34af653744f635eb4fec5d88ca22587
MD5 cd728fc8efeae953d9778ffde51cc9ee
SHA1 7ca7ee9aca552d9f2a1d5f92532659334caf99fe
SHA512 09d83ffe4a91343f2468b0801a5ebd2596acf80c888e3459fbb635d9ebddaf8731e0adeb48e2abf68d74e69cfef09103054e27d7ca3c5f9a66f5903176dbe4da
SSDEEP 3:LstlNllklkXl2vll:LsX3lP29l
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\za0gztwe.rpc\Local State
Size 1KB
SHA256 426fbdc353ff9f06006415cdaa71264d26d135ba68afe652708a3f785ad0dd34
MD5 1c0493db111965dc51ddc530c640f66a
SHA1 cf4bf0767a43cd7f3123bcf3621eeef90e042d36
SHA512 d944ba53c4c94f3a1da4febde7595f9ba40e39e901f4c526fd022d55453047b1da81723cd599398125b0ec81b11fd141eea60c0e1ac201c6d5545cf4f78e3410
TLSH
T1D91175B061386531E883C51E9413B6675EA62377C892CA987EC82E5A01B62AC7311D38
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2592-364-0x000001F120E00000-0x000001F120EEE000-memory.dmp

Download

memory/4972-235-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-231-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-240-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-238-0x000001F92D840000-0x000001F92D88C000-memory.dmp

Download

memory/4972-237-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-241-0x000001F92DA20000-0x000001F92DB0E000-memory.dmp

Download

memory/4972-242-0x000001F92DB10000-0x000001F92DB46000-memory.dmp

Download

memory/4972-243-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-245-0x000001F92DCD0000-0x000001F92DD20000-memory.dmp

Download

memory/4972-236-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-244-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-234-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-233-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-232-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-230-0x000001F92D720000-0x000001F92D7F8000-memory.dmp

Download

memory/4972-239-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-228-0x000001F92D6A0000-0x000001F92D71C000-memory.dmp

Download

memory/4972-229-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-227-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-226-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-220-0x000001F92D4D0000-0x000001F92D5A2000-memory.dmp

Download

memory/4972-219-0x00007FFD1A67F000-0x00007FFD1A680000-memory.dmp

Download

memory/4972-4-0x000001F911580000-0x000001F911581000-memory.dmp

Download

memory/4972-423-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-424-0x000001F92DCA0000-0x000001F92DCB2000-memory.dmp

Download

memory/4972-425-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-426-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-427-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-428-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download

memory/4972-429-0x00007FFD1A4F0000-0x00007FFD1AE94000-memory.dmp

Download