0f9626653c8358d4e8315b97feafe2ed604ff67a9a159d47219685b2e15c1665

Analysis

max time kernel
150s
max time network
144s
platform
windows10_x64
resource
win10
submitted
25/06/2020, 10:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe
Size 2.3MB
Sample200625-ab2sxtm182
SHA256 0f9626653c8358d4e8315b97feafe2ed604ff67a9a159d47219685b2e15c1665
MD5 ea88caee731920b390e588b51caad38f
SHA1 a61c43ab3544a8ba53661de212741cb9368cdb9d
SHA512 90764f0470312786a0cfe016b5002001e1f461e974cd5da7b08b40f45da690a88ba662c542bc8d4af50ce2c74b372e629757ff853678eb47869c9cb2819acdd7
MD5 SHA1 SHA512

Score

8^/10

spyware

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 312 IoCs

pid	Process
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
4000	chrome.exe
4000	chrome.exe
2552	chrome.exe
2552	chrome.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
1652	chrome.exe
1652	chrome.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
1980	chrome.exe
1980	chrome.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
4864	chrome.exe
4864	chrome.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
4908	chrome.exe
4908	chrome.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
4156	chrome.exe
4156	chrome.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
4252	chrome.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe
3864	svhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_metadata\computed_hashes.json	chrome.exe
File opened for modification	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp	chrome.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\8320.407.0.1_0\_metadata\computed_hashes.json	chrome.exe

Suspicious use of WriteProcessMemory 710 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3236 wrote to memory of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67
PID 3864 wrote to memory of 4000	3864	svhost.exe	68
PID 3864 wrote to memory of 4000	3864	svhost.exe	68
PID 4000 wrote to memory of 3508	4000	chrome.exe	69
PID 4000 wrote to memory of 3508	4000	chrome.exe	69
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 760	4000	chrome.exe	70
PID 4000 wrote to memory of 2552	4000	chrome.exe	71
PID 4000 wrote to memory of 2552	4000	chrome.exe	71
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 3952	4000	chrome.exe	72
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 820	4000	chrome.exe	73
PID 4000 wrote to memory of 1652	4000	chrome.exe	75
PID 4000 wrote to memory of 1652	4000	chrome.exe	75
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 2092	4000	chrome.exe	76
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 1944	4000	chrome.exe	77
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 764	4000	chrome.exe	78
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 3788	4000	chrome.exe	79
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1716	4000	chrome.exe	80
PID 4000 wrote to memory of 1980	4000	chrome.exe	81
PID 4000 wrote to memory of 1980	4000	chrome.exe	81
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 1528	4000	chrome.exe	82
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 3424	4000	chrome.exe	83
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 2880	4000	chrome.exe	84
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 3828	4000	chrome.exe	85
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 1660	4000	chrome.exe	86
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3788	4000	chrome.exe	87
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 3620	4000	chrome.exe	88
PID 4000 wrote to memory of 4864	4000	chrome.exe	89
PID 4000 wrote to memory of 4864	4000	chrome.exe	89
PID 4000 wrote to memory of 4908	4000	chrome.exe	90
PID 4000 wrote to memory of 4908	4000	chrome.exe	90
PID 4000 wrote to memory of 4156	4000	chrome.exe	97
PID 4000 wrote to memory of 4156	4000	chrome.exe	97
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4200	4000	chrome.exe	98
PID 4000 wrote to memory of 4252	4000	chrome.exe	99
PID 4000 wrote to memory of 4252	4000	chrome.exe	99

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3236 set thread context of 3864	3236	SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe	67

Executes dropped EXE 1 IoCs

pid	Process
3864	svhost.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen9.53721.11492.17139.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:3236
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3864
- - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Admin\AppData\Roaming\SecureEx" --silent-launch
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Drops Chrome extension
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=83.0.4103.106 --initial-client-data=0xb4,0xb8,0xbc,0x90,0xc0,0x7ffa3427bd28,0x7ffa3427bd38,0x7ffa3427bd48
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1536 /prefetch:2
      4⤵
      PID:760
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1596 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2552
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
      4⤵
      PID:820
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3288 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1652
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3288 /prefetch:8
      4⤵
      PID:2092
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3280 /prefetch:8
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3532 /prefetch:8
      4⤵
      PID:764
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3704 /prefetch:8
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3828 /prefetch:8
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=3628 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1980
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3820 /prefetch:8
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4116 /prefetch:8
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3888 /prefetch:8
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=4124 /prefetch:8
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3788 /prefetch:8
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=1960 /prefetch:8
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=2136 /prefetch:8
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=2128 /prefetch:8
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3668 /prefetch:8
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
      "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1508,417368111950000066,3628279260309429505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAEAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1524 /prefetch:2
      4⤵
      PID:4252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/760-8-0x00007FFA405B0000-0x00007FFA405B1000-memory.dmp

Download

memory/820-30-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-36-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-57-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-15-0x00006E5800040000-0x00006E5800041000-memory.dmp

Download

memory/820-56-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-55-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-54-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-19-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-20-0x000001ADF51F0000-0x000001ADF51F1000-memory.dmp

Download

memory/820-21-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-22-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-23-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-24-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-25-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-26-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-27-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-28-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-29-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-53-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-31-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-32-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-33-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-34-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-35-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-52-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-37-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-38-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-39-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-40-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-41-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-42-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-43-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-44-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-45-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-46-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-47-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-48-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-49-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-50-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/820-51-0x000001ADF2A70000-0x000001ADF2A700F8-memory.dmp

Download

memory/3424-239-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-224-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-208-0x0000417800040000-0x0000417800041000-memory.dmp

Download

memory/3424-209-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-210-0x0000021BDE870000-0x0000021BDE871000-memory.dmp

Download

memory/3424-211-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-212-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-213-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-214-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-215-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-216-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-217-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-218-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-219-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-220-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-221-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-222-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-223-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-225-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-226-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-227-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-228-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-229-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-230-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-231-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-232-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-233-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-234-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-235-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-236-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-237-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-238-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-240-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-241-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-242-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-243-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-244-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-245-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-246-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3424-247-0x0000021BDC630000-0x0000021BDC6300F8-memory.dmp

Download

memory/3620-276-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-265-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-300-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-297-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-296-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-295-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-261-0x000012AA00040000-0x000012AA00041000-memory.dmp

Download

memory/3620-262-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-263-0x0000018C11150000-0x0000018C11151000-memory.dmp

Download

memory/3620-293-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-264-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-298-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-266-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-267-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-268-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-269-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-270-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-271-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-272-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-273-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-274-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-299-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-275-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-283-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-294-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-278-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-279-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-280-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-281-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-282-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-277-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-292-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-284-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-285-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-286-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-287-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-288-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-289-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-290-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3620-291-0x0000018C0EF80000-0x0000018C0EF800F8-memory.dmp

Download

memory/3864-0-0x0000000000400000-0x00000000006FD000-memory.dmp

Download

memory/3864-3-0x0000000000400000-0x00000000006FD000-memory.dmp

Download

memory/3952-74-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-98-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-59-0x000008A600040000-0x000008A600041000-memory.dmp

Download

memory/3952-60-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-61-0x000002CFEEF40000-0x000002CFEEF41000-memory.dmp

Download

memory/3952-62-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-63-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-64-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-65-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-66-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-67-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-68-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-69-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-70-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-71-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-72-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-73-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-75-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-76-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-77-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-78-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-79-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-80-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-81-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-82-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-83-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-84-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-85-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-86-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-87-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-88-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-89-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-90-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-91-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-92-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-93-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-94-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-95-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-96-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/3952-97-0x000002CFED020000-0x000002CFED0200F8-memory.dmp

Download

memory/4000-189-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-106-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-153-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-152-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-151-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-150-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-149-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-148-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-147-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-146-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-145-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-144-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-143-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-142-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-141-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-140-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-139-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-138-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-137-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-136-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-135-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-134-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-133-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-132-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-131-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-130-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-129-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-128-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-127-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-126-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-125-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-124-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-123-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-122-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-121-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-120-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-119-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-118-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-117-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-116-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-115-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-114-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-113-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-112-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-111-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-110-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-109-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-108-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-107-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-154-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-105-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-195-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-193-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-194-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-192-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-191-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-190-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-155-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-188-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-187-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-186-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-185-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-184-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-183-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-182-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-181-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-180-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-179-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-178-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-177-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-176-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-175-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-174-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-173-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-172-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-171-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-170-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-169-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-168-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-167-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-166-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-165-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-164-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-163-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-162-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-161-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-160-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-159-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-158-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-157-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download

memory/4000-156-0x00000143A9160000-0x00000143A9161000-memory.dmp

Download