agenttesla | 9c1f76b540f055b2b6131cde2f6896e73f3e0170070c0551d90d20364156d32c

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7
submitted
13-07-2020 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shipping Documents.exe
Size

652KB
MD5

9ad127f4f4d28ea19395cb16c194f23d
SHA1

21ce15a2f1ee49d7420ea368e51cf92b61028a4c
SHA256

9c1f76b540f055b2b6131cde2f6896e73f3e0170070c0551d90d20364156d32c
SHA512

b3e6f896c4d0747e0d575b1abc63eb96eb0cd791bce21275c44b58731494fa143f1ba03ea6185ee1d3c25366c32e8b26bdefdd4624f0f9780e3e8fcc64665d13

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
smtp.yandex.com
Port:
587
Username:
[email protected]
Password:
ikechukwu112

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla Payload 4 IoCs

resource	yara_rule
behavioral1/memory/2300-281-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2300-282-0x0000000000447A3E-mapping.dmp	family_agenttesla
behavioral1/memory/2300-283-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla
behavioral1/memory/2300-284-0x0000000000400000-0x000000000044C000-memory.dmp	family_agenttesla

Executes dropped EXE 4 IoCs

pid	Process
2072	software_reporter_tool.exe
2112	software_reporter_tool.exe
2332	software_reporter_tool.exe
1408	software_reporter_tool.exe

Patched UPX-packed file 7 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
behavioral1/files/0x00030000000133d9-304.dat	patched_upx
behavioral1/files/0x00030000000133d9-306.dat	patched_upx
behavioral1/files/0x00030000000133d9-308.dat	patched_upx
behavioral1/files/0x00030000000133d9-311.dat	patched_upx
behavioral1/files/0x00030000000133eb-317.dat	patched_upx
behavioral1/files/0x00030000000133eb-322.dat	patched_upx
behavioral1/files/0x00030000000133d9-327.dat	patched_upx

Loads dropped DLL 8 IoCs

pid	Process
1420	chrome.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe
2332	software_reporter_tool.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 616 set thread context of 2300	616	Shipping Documents.exe	47

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1496	chrome.exe
1420	chrome.exe
1420	chrome.exe
3052	chrome.exe
2300	Shipping Documents.exe
2300	Shipping Documents.exe
2512	chrome.exe
2632	chrome.exe
2912	chrome.exe
1420	chrome.exe
1420	chrome.exe
2072	software_reporter_tool.exe
2072	software_reporter_tool.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	Shipping Documents.exe
Token: 33	2112	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2112	software_reporter_tool.exe
Token: 33	2072	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2072	software_reporter_tool.exe
Token: 33	2332	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	2332	software_reporter_tool.exe
Token: 33	1408	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	1408	software_reporter_tool.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe
1420	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2300	Shipping Documents.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1460	1420	chrome.exe	25
PID 1420 wrote to memory of 1460	1420	chrome.exe	25
PID 1420 wrote to memory of 1460	1420	chrome.exe	25
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1528	1420	chrome.exe	26
PID 1420 wrote to memory of 1496	1420	chrome.exe	27
PID 1420 wrote to memory of 1496	1420	chrome.exe	27
PID 1420 wrote to memory of 1496	1420	chrome.exe	27
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28
PID 1420 wrote to memory of 1764	1420	chrome.exe	28

C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"
1⤵
- Suspicious use of SetThreadContext
PID:616
- C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2300

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=83.0.4103.106 --initial-client-data=0xa4,0xa8,0xac,0x78,0xb0,0x7fefb3ebd28,0x7fefb3ebd38,0x7fefb3ebd48
  2⤵
  PID:1460
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1080 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1696 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --instant-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1320 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3200 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3268 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:528
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --disable-gpu-compositing --lang=en-US --extension-process --enable-auto-reload --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=1464 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=1684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=540 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1492 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:472
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1796 /prefetch:8
  2⤵
  PID:528
- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
  "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=944,14059893151287167418,4447884844371826383,131072 --lang=en-US --service-sandbox-type=utility --enable-audio-service-sandbox --mojo-platform-channel-handle=1784 /prefetch:8
  2⤵
  PID:2020
- C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\83.238.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=U6TA3lEPuCM7m2R+nqS0fmBQ1DHjLSXIPrmTqA+e --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2072
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=83.238.200 --initial-client-data=0x160,0x164,0x168,0x134,0x16c,0x13f509928,0x13f509938,0x13f509948
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2072_KMLGOUGIADJNOVFC" --sandboxed-process-id=2 --init-done-notifier=484 --sandbox-mojo-pipe-token=2723197499843145390 --mojo-platform-channel-handle=456 --engine=2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\83.238.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_2072_KMLGOUGIADJNOVFC" --sandboxed-process-id=3 --init-done-notifier=644 --sandbox-mojo-pipe-token=1792513728913948937 --mojo-platform-channel-handle=640
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-147-0x0000000020130000-0x0000000020153000-memory.dmp

Filesize
140KB

Download
memory/1420-126-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-149-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-148-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-122-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-146-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-142-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-123-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-141-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-140-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-137-0x000000001CC10000-0x000000001CC33000-memory.dmp

Filesize
140KB

Download
memory/1420-136-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-135-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-134-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-132-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-130-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-129-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-128-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-127-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-150-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-125-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1420-124-0x000000001E800000-0x000000001E811000-memory.dmp

Filesize
68KB

Download
memory/1528-4-0x0000000077CB0000-0x0000000077CB1000-memory.dmp

Filesize
4KB

Download
memory/1528-1-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/1640-45-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-35-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-19-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-20-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-21-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-22-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-23-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-24-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-25-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-26-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-27-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-28-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-29-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-30-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-31-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-32-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-33-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-34-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-36-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-37-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-38-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-39-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-40-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-41-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-42-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-43-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-44-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-46-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-47-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-48-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-49-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-50-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-51-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-52-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-53-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-54-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-55-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-56-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-57-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-58-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-18-0x0000000008870000-0x0000000008881000-memory.dmp

Filesize
68KB

Download
memory/1640-59-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-60-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1640-61-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-85-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-69-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-65-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-66-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-105-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-104-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-103-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-102-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-101-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-100-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-99-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-98-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-97-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-96-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-87-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-94-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-93-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-92-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-91-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-90-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-89-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-88-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-95-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-64-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-78-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-67-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-84-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-83-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-82-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-81-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-80-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-79-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-63-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-77-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-76-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-75-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-74-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-73-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-72-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-71-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-70-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-86-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-16-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/1764-15-0x0000000009D80000-0x0000000009D91000-memory.dmp

Filesize
68KB

Download
memory/1764-14-0x000007F700040000-0x000007F700041000-memory.dmp

Filesize
4KB

Download
memory/1764-68-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-251-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-258-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-249-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-248-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-278-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-277-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-275-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-274-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-273-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-272-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-271-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-270-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-269-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-268-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-267-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-266-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-265-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-264-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-263-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-262-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-261-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-260-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-259-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-250-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-257-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-256-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-255-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-254-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-253-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-252-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-234-0x00000000089F0000-0x0000000008A01000-memory.dmp

Filesize
68KB

Download
memory/2052-236-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-237-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-238-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-239-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-240-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-241-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-242-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-243-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-244-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-245-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-246-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2052-247-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2300-283-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2300-284-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2300-281-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2776-203-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-192-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-201-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-200-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-199-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-198-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-197-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-196-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-195-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-194-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-193-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-185-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-186-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-204-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-205-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-206-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-207-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-208-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-190-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-187-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-188-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-184-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-183-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-182-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-181-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-202-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-180-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-191-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-179-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-178-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-177-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-209-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-176-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-175-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-174-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-173-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-172-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-171-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-170-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-169-0x0000000007DC0000-0x0000000007DD1000-memory.dmp

Filesize
68KB

Download
memory/2776-168-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-210-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-211-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-212-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-215-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download
memory/2776-189-0x0000000000080000-0x00000000000800B0-memory.dmp

Filesize
176B

Download