redline | e9c754037d5a8041b7ae49d0fe58ccf05c1369b7d801d53fb7a6d4d24002df27

Analysis

max time kernel
150s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
11-12-2020 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FakeNordVPN_small.exe
Size

511KB
MD5

49525eb68b10c8c3384f7ab078cc0dfa
SHA1

fe5629684c1a429f7944696800ceaf8135b8568b
SHA256

e9c754037d5a8041b7ae49d0fe58ccf05c1369b7d801d53fb7a6d4d24002df27
SHA512

82f63c7db8dc7bd14461aa276f2bca6c7ee62c57f9a4adef0380ce31778138a6444da7f8e5b13d8a2dff8f4de97d2e06ab6a7f3c7c58649bb8a72ca191923e4e

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1028-477-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline
behavioral2/memory/1028-478-0x00000000004212DA-mapping.dmp	family_redline

Suspicious use of SetThreadContext 1 IoCs

Processes:

FakeNordVPN_small.exe

description pid process target process

PID 508 set thread context of 1028 508 FakeNordVPN_small.exe FakeNordVPN_small.exe

description	pid	process	target process
PID 508 set thread context of 1028	508	FakeNordVPN_small.exe	FakeNordVPN_small.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
2192	chrome.exe
2192	chrome.exe
2024	chrome.exe
2024	chrome.exe
4144	chrome.exe
4144	chrome.exe
4496	chrome.exe
4496	chrome.exe
4444	chrome.exe
4444	chrome.exe
4400	chrome.exe
4400	chrome.exe
4712	chrome.exe
4712	chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

FakeNordVPN_small.exeFakeNordVPN_small.exe

description pid process

Token: SeDebugPrivilege 508 FakeNordVPN_small.exe
Token: SeDebugPrivilege 1028 FakeNordVPN_small.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

chrome.exe

pid process

2024 chrome.exe
2024 chrome.exe
2024 chrome.exe

description	pid	process
Token: SeDebugPrivilege	508	FakeNordVPN_small.exe
Token: SeDebugPrivilege	1028	FakeNordVPN_small.exe

pid	process
2024	chrome.exe
2024	chrome.exe
2024	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2024 wrote to memory of 2232	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2232	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2164	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2192	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2192	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe
PID 2024 wrote to memory of 2756	2024	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\FakeNordVPN_small.exe
"C:\Users\Admin\AppData\Local\Temp\FakeNordVPN_small.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:508

C:\Users\Admin\AppData\Local\Temp\FakeNordVPN_small.exe
"C:\Users\Admin\AppData\Local\Temp\FakeNordVPN_small.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9b6276e00,0x7ff9b6276e10,0x7ff9b6276e20
2⤵
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1480 /prefetch:2
2⤵
PID:2164

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1668 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
2⤵
PID:2756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:1
2⤵
PID:1744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
2⤵
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
2⤵
PID:60

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3696 /prefetch:1
2⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:3208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4380 /prefetch:8
2⤵
PID:4212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:8
2⤵
PID:4868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4608 /prefetch:8
2⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4524 /prefetch:8
2⤵
PID:4952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5364 /prefetch:8
2⤵
PID:4992

C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
2⤵
PID:5008

C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7ff7f9ac7740,0x7ff7f9ac7750,0x7ff7f9ac7760
3⤵
PID:5052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4420 /prefetch:8
2⤵
PID:5060

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5012 /prefetch:8
2⤵
PID:4372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
2⤵
PID:4412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5680 /prefetch:8
2⤵
PID:4460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5516 /prefetch:8
2⤵
PID:4544

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:8
2⤵
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4960 /prefetch:8
2⤵
PID:4640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6080 /prefetch:8
2⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4604 /prefetch:8
2⤵
PID:4728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5364 /prefetch:8
2⤵
PID:4836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:8
2⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6148 /prefetch:8
2⤵
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4948 /prefetch:8
2⤵
PID:4652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:8
2⤵
PID:4892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6352 /prefetch:8
2⤵
PID:4960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4556 /prefetch:8
2⤵
PID:5016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5572 /prefetch:8
2⤵
PID:2124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
2⤵
PID:5100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5952 /prefetch:8
2⤵
PID:5088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4580 /prefetch:8
2⤵
PID:3180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3688 /prefetch:8
2⤵
PID:4244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4304 /prefetch:8
2⤵
PID:4368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4352 /prefetch:8
2⤵
PID:3364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3760 /prefetch:8
2⤵
PID:4236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4356 /prefetch:8
2⤵
PID:4656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7188 /prefetch:8
2⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:1
2⤵
PID:4408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7456 /prefetch:8
2⤵
PID:4372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7328 /prefetch:8
2⤵
PID:4908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7848 /prefetch:8
2⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7864 /prefetch:8
2⤵
PID:4644

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
2⤵
PID:576

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5892 /prefetch:8
2⤵
PID:908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5928 /prefetch:8
2⤵
PID:2504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8440 /prefetch:8
2⤵
PID:4220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8636 /prefetch:8
2⤵
PID:4240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8136 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2448 /prefetch:8
2⤵
PID:4928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2000 /prefetch:8
2⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7996 /prefetch:8
2⤵
PID:2340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5876 /prefetch:8
2⤵
PID:4852

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1468,11497736439869814532,15800952035874880628,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 /prefetch:8
2⤵
PID:4104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5
6f279482690363c5865d394560329c0f

SHA1
777fa2deccffebaa6795909fe859a3e23329527f

SHA256
173922c34ba9ae0d4ff7dfbacb366a2ecb8d16ff3fd0ce8dddacf6df0dc17076

SHA512
f0e9e3fa154818ed283835cf03fa313840e282f6c759059cdf3e26245b7da69d114dc4e1164998d909eba3afc923e9ee28000b54176fe42fbfd0cd2db5862683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FakeNordVPN_small.exe.log

MD5
957779c42144282d8cd83192b8fbc7cf

SHA1
de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

SHA256
0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

SHA512
f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

Download Submit
\??\pipe\crashpad_2024_UIPMNFUBSFZFDVVB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/60-20-0x0000000000000000-mapping.dmp

Download
memory/60-72-0x0000022B81890000-0x0000022B81891000-memory.dmp

Filesize
4KB

Download
memory/60-27-0x000022B700040000-0x000022B700041000-memory.dmp

Filesize
4KB

Download
memory/508-475-0x0000000004F30000-0x0000000004F48000-memory.dmp

Filesize
96KB

Download
memory/508-2-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/508-3-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/508-476-0x0000000000E90000-0x0000000000E9D000-memory.dmp

Filesize
52KB

Download
memory/576-321-0x000001BF81DC0000-0x000001BF81DC1000-memory.dmp

Filesize
4KB

Download
memory/576-240-0x0000655B00040000-0x0000655B00041000-memory.dmp

Filesize
4KB

Download
memory/576-229-0x0000000000000000-mapping.dmp

Download
memory/908-230-0x0000000000000000-mapping.dmp

Download
memory/1028-478-0x00000000004212DA-mapping.dmp

Download
memory/1028-484-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/1028-477-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1028-483-0x0000000005B30000-0x0000000005B31000-memory.dmp

Filesize
4KB

Download
memory/1028-480-0x0000000073520000-0x0000000073C0E000-memory.dmp

Filesize
6.9MB

Download
memory/1028-485-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/1028-486-0x0000000005520000-0x0000000005521000-memory.dmp

Filesize
4KB

Download
memory/1028-487-0x0000000005780000-0x0000000005781000-memory.dmp

Filesize
4KB

Download
memory/1744-46-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-32-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-37-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-36-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-34-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-38-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-39-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-40-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-41-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-42-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-43-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-44-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-12-0x0000000000000000-mapping.dmp

Download
memory/1744-47-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-45-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-48-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-50-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-49-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-52-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-54-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-56-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-55-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-53-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-51-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-57-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-58-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-59-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-60-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-61-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-62-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-63-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-65-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-66-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-68-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-33-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-67-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-64-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-31-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-30-0x000001995C230000-0x000001995C231000-memory.dmp

Filesize
4KB

Download
memory/1744-24-0x00005FEF00040000-0x00005FEF00041000-memory.dmp

Filesize
4KB

Download
memory/2024-155-0x0000022134B70000-0x0000022134B71000-memory.dmp

Filesize
4KB

Download
memory/2124-198-0x0000000000000000-mapping.dmp

Download
memory/2164-9-0x00007FF9C2D50000-0x00007FF9C2D51000-memory.dmp

Filesize
4KB

Download
memory/2164-7-0x0000000000000000-mapping.dmp

Download
memory/2192-8-0x0000000000000000-mapping.dmp

Download
memory/2232-5-0x0000000000000000-mapping.dmp

Download
memory/2340-488-0x0000000000000000-mapping.dmp

Download
memory/2504-233-0x0000000000000000-mapping.dmp

Download
memory/2756-125-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-123-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-132-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-133-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-134-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-135-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-136-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-137-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-138-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-139-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-142-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-143-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-145-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-146-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-148-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-150-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-151-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-149-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-147-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-144-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-141-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-140-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-131-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-130-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-129-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-11-0x0000000000000000-mapping.dmp

Download
memory/2756-128-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-127-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-126-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-124-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-112-0x000033B000040000-0x000033B000041000-memory.dmp

Filesize
4KB

Download
memory/2756-113-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-114-0x0000017F26F60000-0x0000017F26F61000-memory.dmp

Filesize
4KB

Download
memory/2756-116-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-117-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-118-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-115-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-119-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-120-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-121-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2756-122-0x0000017F25370000-0x0000017F253700F8-memory.dmp

Filesize
248B

Download
memory/2824-105-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-86-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-102-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-103-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-104-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-76-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-106-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-107-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-108-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-109-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-110-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-100-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-99-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-97-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-98-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-96-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-95-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-94-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-93-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-92-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-91-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-90-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-89-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-84-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-88-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-85-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-87-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-101-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-83-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-82-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-81-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-80-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-75-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-15-0x0000000000000000-mapping.dmp

Download
memory/2824-79-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-78-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-77-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-74-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-73-0x000001323CAC0000-0x000001323CAC1000-memory.dmp

Filesize
4KB

Download
memory/2824-35-0x000001323AC40000-0x000001323AC400F8-memory.dmp

Filesize
248B

Download
memory/2824-23-0x0000058C00040000-0x0000058C00041000-memory.dmp

Filesize
4KB

Download
memory/3036-71-0x0000020601D20000-0x0000020601D21000-memory.dmp

Filesize
4KB

Download
memory/3036-18-0x0000000000000000-mapping.dmp

Download
memory/3036-26-0x00004AF000040000-0x00004AF000041000-memory.dmp

Filesize
4KB

Download
memory/3180-204-0x0000000000000000-mapping.dmp

Download
memory/3208-25-0x0000731D00040000-0x0000731D00041000-memory.dmp

Filesize
4KB

Download
memory/3208-70-0x000002E181D30000-0x000002E181D31000-memory.dmp

Filesize
4KB

Download
memory/3208-17-0x0000000000000000-mapping.dmp

Download
memory/3364-210-0x0000000000000000-mapping.dmp

Download
memory/4104-492-0x0000000000000000-mapping.dmp

Download
memory/4144-166-0x0000000000000000-mapping.dmp

Download
memory/4212-28-0x0000000000000000-mapping.dmp

Download
memory/4220-235-0x0000000000000000-mapping.dmp

Download
memory/4236-212-0x0000000000000000-mapping.dmp

Download
memory/4240-238-0x0000000000000000-mapping.dmp

Download
memory/4244-206-0x0000000000000000-mapping.dmp

Download
memory/4324-473-0x0000000000000000-mapping.dmp

Download
memory/4368-208-0x0000000000000000-mapping.dmp

Download
memory/4372-220-0x0000000000000000-mapping.dmp

Download
memory/4372-167-0x0000000000000000-mapping.dmp

Download
memory/4400-469-0x0000000000000000-mapping.dmp

Download
memory/4408-299-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-297-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-313-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-287-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-311-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-282-0x000002BF4F470000-0x000002BF4F471000-memory.dmp

Filesize
4KB

Download
memory/4408-283-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-284-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-312-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-285-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-281-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-289-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-290-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-237-0x000067C700040000-0x000067C700041000-memory.dmp

Filesize
4KB

Download
memory/4408-291-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-292-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-293-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-294-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-296-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-295-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-298-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-300-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-301-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-288-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-319-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-318-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-317-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-316-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-315-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-314-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-302-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-286-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-219-0x0000000000000000-mapping.dmp

Download
memory/4408-310-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-309-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-308-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-307-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-306-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-305-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-304-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4408-303-0x000002BF4CA60000-0x000002BF4CA600F8-memory.dmp

Filesize
248B

Download
memory/4412-169-0x0000000000000000-mapping.dmp

Download
memory/4444-468-0x0000000000000000-mapping.dmp

Download
memory/4460-171-0x0000000000000000-mapping.dmp

Download
memory/4496-173-0x0000000000000000-mapping.dmp

Download
memory/4544-174-0x0000000000000000-mapping.dmp

Download
memory/4588-176-0x0000000000000000-mapping.dmp

Download
memory/4640-178-0x0000000000000000-mapping.dmp

Download
memory/4644-227-0x0000000000000000-mapping.dmp

Download
memory/4652-190-0x0000000000000000-mapping.dmp

Download
memory/4656-214-0x0000000000000000-mapping.dmp

Download
memory/4668-180-0x0000000000000000-mapping.dmp

Download
memory/4712-472-0x0000000000000000-mapping.dmp

Download
memory/4728-182-0x0000000000000000-mapping.dmp

Download
memory/4772-188-0x0000000000000000-mapping.dmp

Download
memory/4800-186-0x0000000000000000-mapping.dmp

Download
memory/4836-184-0x0000000000000000-mapping.dmp

Download
memory/4848-217-0x0000000000000000-mapping.dmp

Download
memory/4852-490-0x0000000000000000-mapping.dmp

Download
memory/4868-153-0x0000000000000000-mapping.dmp

Download
memory/4892-192-0x0000000000000000-mapping.dmp

Download
memory/4908-223-0x0000000000000000-mapping.dmp

Download
memory/4912-156-0x0000000000000000-mapping.dmp

Download
memory/4928-470-0x0000000000000000-mapping.dmp

Download
memory/4952-158-0x0000000000000000-mapping.dmp

Download
memory/4960-194-0x0000000000000000-mapping.dmp

Download
memory/4992-160-0x0000000000000000-mapping.dmp

Download
memory/5008-162-0x0000000000000000-mapping.dmp

Download
memory/5016-196-0x0000000000000000-mapping.dmp

Download
memory/5032-225-0x0000000000000000-mapping.dmp

Download
memory/5052-164-0x0000000000000000-mapping.dmp

Download
memory/5060-163-0x0000000000000000-mapping.dmp

Download
memory/5088-201-0x0000000000000000-mapping.dmp

Download
memory/5100-260-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-258-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-278-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-271-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-270-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-269-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-268-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-266-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-267-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-265-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-264-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-263-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-262-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-261-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-276-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-251-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-259-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-252-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-253-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-254-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-255-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-277-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-257-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-256-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-250-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-249-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-248-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-247-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-246-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-245-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-244-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-241-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-242-0x0000019531C10000-0x0000019531C11000-memory.dmp

Filesize
4KB

Download
memory/5100-243-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-275-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-279-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-274-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-273-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-272-0x000001952F9D0000-0x000001952F9D00F8-memory.dmp

Filesize
248B

Download
memory/5100-216-0x00007C5300040000-0x00007C5300041000-memory.dmp

Filesize
4KB

Download
memory/5100-200-0x0000000000000000-mapping.dmp

Download