agenttesla | 9c1f76b540f055b2b6131cde2f6896e73f3e0170070c0551d90d20364156d32c

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7
submitted
13-07-2020 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shipping Documents.exe
Size

652KB
MD5

9ad127f4f4d28ea19395cb16c194f23d
SHA1

21ce15a2f1ee49d7420ea368e51cf92b61028a4c
SHA256

9c1f76b540f055b2b6131cde2f6896e73f3e0170070c0551d90d20364156d32c
SHA512

b3e6f896c4d0747e0d575b1abc63eb96eb0cd791bce21275c44b58731494fa143f1ba03ea6185ee1d3c25366c32e8b26bdefdd4624f0f9780e3e8fcc64665d13

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
ikechukwu112

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2300-281-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2300-282-0x0000000000447A3E-mapping.dmp	family_agenttesla
behavioral1/memory/2300-283-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2300-284-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Executes dropped EXE 4 IoCs

Processes:

software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

pid process

2072 software_reporter_tool.exe
2112 software_reporter_tool.exe
2332 software_reporter_tool.exe
1408 software_reporter_tool.exe

pid	process
2072	software_reporter_tool.exe
2112	software_reporter_tool.exe
2332	software_reporter_tool.exe
1408	software_reporter_tool.exe

Patched UPX-packed file 7 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe	patched_upx
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\em003_64.dll	patched_upx
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\em003_64.dll	patched_upx
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe	patched_upx

Loads dropped DLL 8 IoCs

Processes:

chrome.exesoftware_reporter_tool.exe

pid	process
1420	chrome.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Shipping Documents.exe

description pid process target process

PID 616 set thread context of 2300 616 Shipping Documents.exe Shipping Documents.exe

description	pid	process	target process
PID 616 set thread context of 2300	616	Shipping Documents.exe	Shipping Documents.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

chrome.exechrome.exechrome.exeShipping Documents.exechrome.exechrome.exechrome.exesoftware_reporter_tool.exe

pid	process
1496	chrome.exe
1420	chrome.exe
1420	chrome.exe
3052	chrome.exe
2300	Shipping Documents.exe
2300	Shipping Documents.exe
2512	chrome.exe
2632	chrome.exe
2912	chrome.exe
1420	chrome.exe
1420	chrome.exe
2072	software_reporter_tool.exe
2072	software_reporter_tool.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

Shipping Documents.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

description	pid	process
Token: SeDebugPrivilege	2300	Shipping Documents.exe
Token: 33	2112	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2112	software_reporter_tool.exe
Token: 33	2072	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2072	software_reporter_tool.exe
Token: 33	2332	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2332	software_reporter_tool.exe
Token: 33	1408	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1408	software_reporter_tool.exe

Suspicious use of FindShellTrayWindow 34 IoCs

Processes:

chrome.exe

pid	process
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Shipping Documents.exe

pid process

2300 Shipping Documents.exe

pid	process
2300	Shipping Documents.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1420 wrote to memory of 1460	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1460	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1460	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1528	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1496	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1496	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1496	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe
PID 1420 wrote to memory of 1764	1420	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
1⤵
- Suspicious use of SetThreadContext
PID:616

C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2300

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=83.0.4103.106 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7fefb3ebd28,0x7fefb3ebd38,0x7fefb3ebd48
2⤵
PID:1460

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1080 /prefetch:2
2⤵
PID:1528

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1252 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1496

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
2⤵
PID:1764

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --instant-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
2⤵
PID:1640

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1320 /prefetch:2
2⤵
PID:2196

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2548 /prefetch:8
2⤵
PID:2300

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2632 /prefetch:8
2⤵
PID:2320

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:2360

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2736 /prefetch:8
2⤵
PID:2440

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3112 /prefetch:8
2⤵
PID:2600

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3240 /prefetch:8
2⤵
PID:2644

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3200 /prefetch:8
2⤵
PID:2688

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3268 /prefetch:8
2⤵
PID:2732

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:2776

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=2924 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3000 /prefetch:8
2⤵
PID:528

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2836 /prefetch:8
2⤵
PID:1560

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2740 /prefetch:8
2⤵
PID:828

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:2120

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:1
2⤵
PID:2052

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=1464 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2512

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=1684 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=540 /prefetch:8
2⤵
PID:2944

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=604 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2912

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1492 /prefetch:8
2⤵
PID:3000

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3052 /prefetch:8
2⤵
PID:472

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1796 /prefetch:8
2⤵
PID:528

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1784 /prefetch:8
2⤵
PID:2020

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=U6TA3lEPuCM7m2R+nqS0fmBQ1DHjLSXIPrmTqA+e --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=83.238.200 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x13f509928,0x13f509938,0x13f509948
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2072_KMLGOUGIADJNOVFC" --sandboxed-process-id=2 --init-done-notifier=484 --sandbox-mojo-pipe-token=2723197499843145390 --mojo-platform-channel-handle=456 --engine=2
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2332

\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe
"c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2072_KMLGOUGIADJNOVFC" --sandboxed-process-id=3 --init-done-notifier=644 --sandbox-mojo-pipe-token=1792513728913948937 --mojo-platform-channel-handle=640
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1408

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe
MD5
06e455a9daa6879a8cd0ade0a6eba9a8

SHA1
697b7669554c33456aa55963e5995791449c94c3

SHA256
b715598d6c6b545e0d91b6b02bdffc9ae73147f03d7953f7477e999ffa1c0eec

SHA512
89a7e60a9bb3d54386eb8767f4c956d6c90befd1026e714565f56fc92e5b82ab87d6756d924edc33b04971cbbaabf44c5b0d42cfaf5143d10fbd04695ebcdb16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe
MD5
06e455a9daa6879a8cd0ade0a6eba9a8

SHA1
697b7669554c33456aa55963e5995791449c94c3

SHA256
b715598d6c6b545e0d91b6b02bdffc9ae73147f03d7953f7477e999ffa1c0eec

SHA512
89a7e60a9bb3d54386eb8767f4c956d6c90befd1026e714565f56fc92e5b82ab87d6756d924edc33b04971cbbaabf44c5b0d42cfaf5143d10fbd04695ebcdb16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe
MD5
06e455a9daa6879a8cd0ade0a6eba9a8

SHA1
697b7669554c33456aa55963e5995791449c94c3

SHA256
b715598d6c6b545e0d91b6b02bdffc9ae73147f03d7953f7477e999ffa1c0eec

SHA512
89a7e60a9bb3d54386eb8767f4c956d6c90befd1026e714565f56fc92e5b82ab87d6756d924edc33b04971cbbaabf44c5b0d42cfaf5143d10fbd04695ebcdb16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe
MD5
06e455a9daa6879a8cd0ade0a6eba9a8

SHA1
697b7669554c33456aa55963e5995791449c94c3

SHA256
b715598d6c6b545e0d91b6b02bdffc9ae73147f03d7953f7477e999ffa1c0eec

SHA512
89a7e60a9bb3d54386eb8767f4c956d6c90befd1026e714565f56fc92e5b82ab87d6756d924edc33b04971cbbaabf44c5b0d42cfaf5143d10fbd04695ebcdb16

Download Submit
C:\Users\Admin\AppData\Local\Google\Software Reporter Tool\software_reporter_tool-sandbox.log
MD5
821f6512c85a3c7d807ab6d3bbc4695c

SHA1
a57cea90aeb43bce70358ce34b5e0d71ff025659

SHA256
ab75e4bee8ad356788239c10276db07b3c3bf9f3f6f2d85b702e45639f733176

SHA512
f3164bd54160a6562f921b996842c693ff8669f5857eb83c80763cc63624c8e17a8df82c4e0ef5705e8e8604e3e3f351c807daee3f00dbc0667ad51646ab3350

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
7387c65637fd7488bffa573d430c0d1d

SHA1
f616afceae64fb601e72399f369adde98552d4f7

SHA256
74387123c8532c2885f8f81eed993bf721890bfedcb4638771d682040a7fda7e

SHA512
3c4b46a59aed6b2c52cc0cc50e13a337da683770ca053f49e00422b05ad812adafae548623985bacce7cbcce67c5d080d6f881180f83d925dec62e23c43d49de

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
7387c65637fd7488bffa573d430c0d1d

SHA1
f616afceae64fb601e72399f369adde98552d4f7

SHA256
74387123c8532c2885f8f81eed993bf721890bfedcb4638771d682040a7fda7e

SHA512
3c4b46a59aed6b2c52cc0cc50e13a337da683770ca053f49e00422b05ad812adafae548623985bacce7cbcce67c5d080d6f881180f83d925dec62e23c43d49de

Download Submit
\??\c:\users\admin\appdata\local\Google\Software Reporter Tool\settings.dat
MD5
7387c65637fd7488bffa573d430c0d1d

SHA1
f616afceae64fb601e72399f369adde98552d4f7

SHA256
74387123c8532c2885f8f81eed993bf721890bfedcb4638771d682040a7fda7e

SHA512
3c4b46a59aed6b2c52cc0cc50e13a337da683770ca053f49e00422b05ad812adafae548623985bacce7cbcce67c5d080d6f881180f83d925dec62e23c43d49de

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\em000_64.dll
MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\em001_64.dll
MD5
d6385decf21bcfec1ab918dc2a4bcfd9

SHA1
aa0a7cc7a68f2653253b0ace7b416b33a289b22e

SHA256
c26081f692c7446a8ef7c9dec932274343faab70427c1861afef260413d79535

SHA512
bbb82176e0d7f8f151e7c7b0812c6897bfacf43f93fd04599380d4f30e2e18e7812628019d7dba5c4b26cbe5a28dc0798c339273e59eee9ee814a66e55d08246

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\em002_64.dll
MD5
44dc73c4c48fd89d6b263759e5962c9c

SHA1
1faaef846827e231f25fe43a9b774c3ed391edfb

SHA256
13c81e295c98dc40baa9b2ba85b686cf898781ab16c4dbc16b526f131cb1bcca

SHA512
bca4e6bd0e93b12e51ddcd13a883d17feae7ec1a3e7731e0fb6388a2e57cbfc55a41a22c554a423d0c8ff2c0d397977e5af98343f46c484e5760abe6c767d47f

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\em003_64.dll
MD5
a2d6788147e20a97ea478a246268a942

SHA1
c62b5bf7fb75ec26e8da583ce4766bde2e99fbe7

SHA256
f2c6547016dd80bdf84c9fca8ff989edc47b725bd6cdbfcfc8f4b60d61506ddc

SHA512
e63ae97b16bfa4612827d3e2774cef7417f2e472860304610fce7bed595423a6d4d543bc15ff91abc4924910c7093ca4b4e5dbfe07ae18944517b2bd381def8c

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\em004_64.dll
MD5
805984e84579d6a80b2cb8c1f4893261

SHA1
8882fdb8eab539a31afb4e9c38d00971d83540df

SHA256
8ea446f0ebfbdaa31d7de6e7477d2a46dfd43e3eb05e8d477a447f189c4366e3

SHA512
143ac93a48bfa297c0fddefb34152c25a02cd6253aa96d6ae1a7ce865a4a6b66546cc416690a05f425d09fa20b7b97b07f27bcf2d2d9dec1cd529762741a5970

Download Submit
\??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\em005_64.dll
MD5
7a326f2232b164767da731888d8b9a0d

SHA1
a8dc41983c8a5c8f1125506926336df732a0db6d

SHA256
a943889cb85d3c4036d1a59419cf5e335232ed76bab5dec9a319c45bf7efb40f

SHA512
4b7bc40ac2277cdd6686934b1f66afb80e9d544b837f388d30b2d53d1dd11a122665ac4f8758e11dd98f7d7c680bcaed29eb1f4a341f8f05c69d77fc45e92be3

Download Submit
\??\pipe\crashpad_1420_YADFJENYKNONQTVC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_2072_KMLGOUGIADJNOVFC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\edls_64.dll
MD5
66ce1b99fc336b839d1875185f611b0e

SHA1
0cd74f334b4244c6ed4a73c896c692024dec1913

SHA256
97a7cece0eceb6dc26d8025ed84b30319b5daef52961eaa5dd4dae815e2ff066

SHA512
636e5c1253496fdbc6c74a051804ec249de97bfb6945a9486bf267e67d366cd1d2b19c136698546ca915de35e8ffc914cd047240e95d20f5f5096569cfd5a69f

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\em000_64.dll
MD5
d0cf72186dbaea05c5a5bf6594225fc3

SHA1
0e69efd78dc1124122dd8b752be92cb1cbc067a1

SHA256
225d4f7e3ab4687f05f817435b883f6c3271b6c4d4018d94fe4398a350d74907

SHA512
8122a9a9205cfa67ff87cb4755089e5ed1acf8f807467216c98f09f94704f98497f7aa57ad29e255efa4d7206c577c4cf7fed140afb046499fc2e57e03f55285

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\em001_64.dll
MD5
d6385decf21bcfec1ab918dc2a4bcfd9

SHA1
aa0a7cc7a68f2653253b0ace7b416b33a289b22e

SHA256
c26081f692c7446a8ef7c9dec932274343faab70427c1861afef260413d79535

SHA512
bbb82176e0d7f8f151e7c7b0812c6897bfacf43f93fd04599380d4f30e2e18e7812628019d7dba5c4b26cbe5a28dc0798c339273e59eee9ee814a66e55d08246

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\em002_64.dll
MD5
44dc73c4c48fd89d6b263759e5962c9c

SHA1
1faaef846827e231f25fe43a9b774c3ed391edfb

SHA256
13c81e295c98dc40baa9b2ba85b686cf898781ab16c4dbc16b526f131cb1bcca

SHA512
bca4e6bd0e93b12e51ddcd13a883d17feae7ec1a3e7731e0fb6388a2e57cbfc55a41a22c554a423d0c8ff2c0d397977e5af98343f46c484e5760abe6c767d47f

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\em003_64.dll
MD5
a2d6788147e20a97ea478a246268a942

SHA1
c62b5bf7fb75ec26e8da583ce4766bde2e99fbe7

SHA256
f2c6547016dd80bdf84c9fca8ff989edc47b725bd6cdbfcfc8f4b60d61506ddc

SHA512
e63ae97b16bfa4612827d3e2774cef7417f2e472860304610fce7bed595423a6d4d543bc15ff91abc4924910c7093ca4b4e5dbfe07ae18944517b2bd381def8c

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\em004_64.dll
MD5
805984e84579d6a80b2cb8c1f4893261

SHA1
8882fdb8eab539a31afb4e9c38d00971d83540df

SHA256
8ea446f0ebfbdaa31d7de6e7477d2a46dfd43e3eb05e8d477a447f189c4366e3

SHA512
143ac93a48bfa297c0fddefb34152c25a02cd6253aa96d6ae1a7ce865a4a6b66546cc416690a05f425d09fa20b7b97b07f27bcf2d2d9dec1cd529762741a5970

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\em005_64.dll
MD5
7a326f2232b164767da731888d8b9a0d

SHA1
a8dc41983c8a5c8f1125506926336df732a0db6d

SHA256
a943889cb85d3c4036d1a59419cf5e335232ed76bab5dec9a319c45bf7efb40f

SHA512
4b7bc40ac2277cdd6686934b1f66afb80e9d544b837f388d30b2d53d1dd11a122665ac4f8758e11dd98f7d7c680bcaed29eb1f4a341f8f05c69d77fc45e92be3

Download Submit
\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe
MD5
06e455a9daa6879a8cd0ade0a6eba9a8

SHA1
697b7669554c33456aa55963e5995791449c94c3

SHA256
b715598d6c6b545e0d91b6b02bdffc9ae73147f03d7953f7477e999ffa1c0eec

SHA512
89a7e60a9bb3d54386eb8767f4c956d6c90befd1026e714565f56fc92e5b82ab87d6756d924edc33b04971cbbaabf44c5b0d42cfaf5143d10fbd04695ebcdb16

Download Submit
memory/472-296-0x0000000000000000-mapping.dmp

Download
memory/528-218-0x0000000000000000-mapping.dmp

Download
memory/528-299-0x0000000000000000-mapping.dmp

Download
memory/616-280-0x0000000000000000-0x0000000000000000-disk.dmp

Download
memory/828-224-0x0000000000000000-mapping.dmp

Download
memory/1408-326-0x0000000000000000-mapping.dmp

Download
memory/1420-147-0x0000000020130000-0x0000000020153000-memory.dmp

Filesize
140KB

Download
memory/1420-126-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-149-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-148-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-122-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-146-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-142-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-123-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-141-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-140-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-137-0x000000001CC10000-0x000000001CC33000-memory.dmp

Filesize
140KB

Download
memory/1420-136-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-135-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-134-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-132-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-130-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-129-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-128-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-127-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-150-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-125-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-124-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1460-0-0x0000000000000000-mapping.dmp

Download
memory/1496-3-0x0000000000000000-mapping.dmp

Download
memory/1528-4-0x0000000077CB0000-0x0000000077CB1000-memory.dmp

Filesize
4KB

Download
memory/1528-2-0x0000000000000000-mapping.dmp

Download
memory/1528-1-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/1560-221-0x0000000000000000-mapping.dmp

Download
memory/1640-45-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-35-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-12-0x0000000000000000-mapping.dmp

Download
memory/1640-19-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-20-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-21-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-22-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-23-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-24-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-25-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-26-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-27-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-28-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-29-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-30-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-31-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-32-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-33-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-34-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-36-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-37-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-38-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-39-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-40-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-41-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-42-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-43-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-44-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-46-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-47-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-48-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-49-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-50-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-51-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-52-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-53-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-54-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-55-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-56-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-57-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-58-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-18-0x0000000008870000-0x0000000008881000-memory.dmp

Filesize
68KB

Download
memory/1640-59-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-60-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-61-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-85-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-69-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-65-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-66-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-105-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-104-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-103-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-102-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-101-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-100-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-99-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-98-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-97-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-96-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-87-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-94-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-93-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-92-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-91-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-90-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-89-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-88-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-95-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-64-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-78-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-67-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-84-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-83-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-82-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-81-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-80-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-79-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-63-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-77-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-76-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-75-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-74-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-73-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-72-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-71-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-70-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-8-0x0000000000000000-mapping.dmp

Download
memory/1764-86-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-16-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-15-0x0000000009D80000-0x0000000009D91000-memory.dmp

Filesize
68KB

Download
memory/1764-14-0x000007F700040000-0x000007F700041000-memory.dmp

Filesize
4KB

Download
memory/1764-68-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2020-302-0x0000000000000000-mapping.dmp

Download
memory/2052-251-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-258-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-249-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-248-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-278-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-277-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-275-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-274-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-273-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-272-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-271-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-270-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-269-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-268-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-267-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-266-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-265-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-264-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-263-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-262-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-261-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-260-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-259-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-250-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-257-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-256-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-255-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-254-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-253-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-252-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-231-0x0000000000000000-mapping.dmp

Download
memory/2052-234-0x00000000089F0000-0x0000000008A01000-memory.dmp

Filesize
68KB

Download
memory/2052-236-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-237-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-238-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-239-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-240-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-241-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-242-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-243-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-244-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-245-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-246-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-247-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2072-305-0x0000000000000000-mapping.dmp

Download
memory/2112-307-0x0000000000000000-mapping.dmp

Download
memory/2120-227-0x0000000000000000-mapping.dmp

Download
memory/2196-108-0x0000000000000000-mapping.dmp

Download
memory/2300-111-0x0000000000000000-mapping.dmp

Download
memory/2300-282-0x0000000000447A3E-mapping.dmp

Download
memory/2300-283-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2300-284-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2300-281-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2320-114-0x0000000000000000-mapping.dmp

Download
memory/2332-310-0x0000000000000000-mapping.dmp

Download
memory/2360-117-0x0000000000000000-mapping.dmp

Download
memory/2440-120-0x0000000000000000-mapping.dmp

Download
memory/2512-286-0x0000000000000000-mapping.dmp

Download
memory/2600-152-0x0000000000000000-mapping.dmp

Download
memory/2632-287-0x0000000000000000-mapping.dmp

Download
memory/2644-155-0x0000000000000000-mapping.dmp

Download
memory/2688-158-0x0000000000000000-mapping.dmp

Download
memory/2732-161-0x0000000000000000-mapping.dmp

Download
memory/2776-203-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-192-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-201-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-200-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-199-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-198-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-197-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-196-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-195-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-194-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-193-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-185-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-186-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-204-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-205-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-206-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-207-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-208-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-190-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-187-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-188-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-184-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-183-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-182-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-181-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-202-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-180-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-191-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-179-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-178-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-177-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-209-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-176-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-175-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-174-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-173-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-172-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-171-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-170-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-169-0x0000000007DC0000-0x0000000007DD1000-memory.dmp

Filesize
68KB

Download
memory/2776-168-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-165-0x0000000000000000-mapping.dmp

Download
memory/2776-210-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-211-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-212-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-215-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-189-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2912-291-0x0000000000000000-mapping.dmp

Download
memory/2944-289-0x0000000000000000-mapping.dmp

Download
memory/3000-293-0x0000000000000000-mapping.dmp

Download
memory/3052-216-0x0000000000000000-mapping.dmp

Download