Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26/12/2020, 11:38

General

  • Target
    SecuriteInfo.com.Trojan.Rasftuby.Gen.14.15706.2547.exe
  • Size 986KB
  • Sample201226-41stqtzvhs
  • SHA256 a408e65fa77a4eded318a05af68fe27f522ec61b0c3e30aa34a5703b06fe2cf8
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • JavaScript code in executable 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2528 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Rasftuby.Gen.14.15706.2547.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Rasftuby.Gen.14.15706.2547.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\SYSTEM32\TASKKILL.exe
        TASKKILL /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4180
      • C:\Windows\regedit.exe
        regedit /s chrome.reg
        3⤵
        • Runs .reg file with regedit
        PID:4172
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c chrome64.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3384
        • C:\Windows\system32\mshta.exe
          mshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4076
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\chrome64.bat" h"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4024
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:/Program Files/Google/Chrome/Application/chrome.exe"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4400
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffeeaf36e00,0x7ffeeaf36e10,0x7ffeeaf36e20
                7⤵
                  PID:1672
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1540 /prefetch:2
                  7⤵
                    PID:832
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1872 /prefetch:8
                    7⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:884
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
                    7⤵
                      PID:1908
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2700 /prefetch:1
                      7⤵
                        PID:1972
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                        7⤵
                          PID:2432
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3416 /prefetch:8
                          7⤵
                            PID:2744
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
                            7⤵
                              PID:2656
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
                              7⤵
                                PID:4656
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
                                7⤵
                                  PID:4256
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4172 /prefetch:8
                                  7⤵
                                    PID:3048
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:8
                                    7⤵
                                      PID:1388
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:8
                                      7⤵
                                        PID:2316
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8
                                        7⤵
                                          PID:1436
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:8
                                          7⤵
                                            PID:2364
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4648 /prefetch:8
                                            7⤵
                                              PID:4192
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:8
                                              7⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4268
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4340 /prefetch:8
                                              7⤵
                                                PID:4088
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:8
                                                7⤵
                                                  PID:2076
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5132 /prefetch:8
                                                  7⤵
                                                    PID:1872
                                                  • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                    "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                                    7⤵
                                                      PID:4288
                                                      • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                        "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff7f14c7740,0x7ff7f14c7750,0x7ff7f14c7760
                                                        8⤵
                                                          PID:2128
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4404 /prefetch:8
                                                        7⤵
                                                          PID:1008
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 /prefetch:8
                                                          7⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:3524
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5364 /prefetch:8
                                                          7⤵
                                                            PID:196
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:8
                                                            7⤵
                                                              PID:1296
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:8
                                                              7⤵
                                                                PID:2460
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5124 /prefetch:8
                                                                7⤵
                                                                  PID:1172
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4200 /prefetch:8
                                                                  7⤵
                                                                    PID:4240
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5680 /prefetch:8
                                                                    7⤵
                                                                      PID:4180
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5540 /prefetch:8
                                                                      7⤵
                                                                        PID:204
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5668 /prefetch:8
                                                                        7⤵
                                                                          PID:4880
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:8
                                                                          7⤵
                                                                            PID:836
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6096 /prefetch:8
                                                                            7⤵
                                                                              PID:4288
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3408 /prefetch:8
                                                                              7⤵
                                                                                PID:2128
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4724 /prefetch:8
                                                                                7⤵
                                                                                  PID:4428
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6248 /prefetch:8
                                                                                  7⤵
                                                                                    PID:4420
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6372 /prefetch:8
                                                                                    7⤵
                                                                                      PID:2964
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6632 /prefetch:8
                                                                                      7⤵
                                                                                        PID:1656
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
                                                                                        7⤵
                                                                                          PID:2608
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6776 /prefetch:8
                                                                                          7⤵
                                                                                            PID:232
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6752 /prefetch:8
                                                                                            7⤵
                                                                                              PID:4380
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7156 /prefetch:8
                                                                                              7⤵
                                                                                                PID:4724
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6888 /prefetch:8
                                                                                                7⤵
                                                                                                  PID:4068
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7424 /prefetch:8
                                                                                                  7⤵
                                                                                                    PID:4044
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4808 /prefetch:8
                                                                                                    7⤵
                                                                                                      PID:2332
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3524 /prefetch:8
                                                                                                      7⤵
                                                                                                        PID:4784
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3836 /prefetch:8
                                                                                                        7⤵
                                                                                                          PID:2240
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
                                                                                                          7⤵
                                                                                                            PID:2160
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:8
                                                                                                            7⤵
                                                                                                              PID:2924
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4252 /prefetch:8
                                                                                                              7⤵
                                                                                                                PID:4404
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4320 /prefetch:8
                                                                                                                7⤵
                                                                                                                  PID:196
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4192 /prefetch:8
                                                                                                                  7⤵
                                                                                                                    PID:3696
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
                                                                                                                    7⤵
                                                                                                                      PID:3600
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5796 /prefetch:8
                                                                                                                      7⤵
                                                                                                                        PID:4164
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5780 /prefetch:8
                                                                                                                        7⤵
                                                                                                                          PID:2632
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5724 /prefetch:8
                                                                                                                          7⤵
                                                                                                                            PID:224
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3436 /prefetch:8
                                                                                                                            7⤵
                                                                                                                              PID:816
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:8
                                                                                                                              7⤵
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              PID:1468
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 /prefetch:8
                                                                                                                              7⤵
                                                                                                                                PID:4044
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3848 /prefetch:8
                                                                                                                                7⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:3172
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2284 /prefetch:8
                                                                                                                                7⤵
                                                                                                                                  PID:2136
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 /prefetch:8
                                                                                                                                  7⤵
                                                                                                                                    PID:3908
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4636 /prefetch:8
                                                                                                                                    7⤵
                                                                                                                                      PID:4180
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6712 /prefetch:8
                                                                                                                                      7⤵
                                                                                                                                        PID:4060
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=4444 /prefetch:2
                                                                                                                                        7⤵
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:4440
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7172 /prefetch:8
                                                                                                                                        7⤵
                                                                                                                                          PID:4444
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,9063690942862634910,2290193971068324693,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6756 /prefetch:8
                                                                                                                                          7⤵
                                                                                                                                            PID:2240
                                                                                                                                  • C:\Windows\regedit.exe
                                                                                                                                    regedit /s chrome-set.reg
                                                                                                                                    3⤵
                                                                                                                                    • Runs .reg file with regedit
                                                                                                                                    PID:2996

                                                                                                                              Network

                                                                                                                                    MITRE ATT&CK Matrix

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    memory/832-25-0x00007FFF05010000-0x00007FFF05011000-memory.dmp

                                                                                                                                    memory/2160-298-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-329-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-307-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-309-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-310-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-312-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-313-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-314-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-316-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-317-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-318-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-319-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-320-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-321-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-322-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-324-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-325-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-326-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-327-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-328-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-303-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-330-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-331-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-323-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-315-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-311-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-308-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-306-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-305-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-304-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-294-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-295-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-296-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-297-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-299-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-300-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-301-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2160-302-0x000001B5CFD30000-0x000001B5CFD300F8-memory.dmp

                                                                                                                                    memory/2432-147-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-133-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-167-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-169-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-168-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-166-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-165-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-164-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-163-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-162-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-161-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-160-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-159-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-158-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-157-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-156-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-155-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-154-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-153-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-151-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-150-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-149-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-148-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-146-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-56-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-152-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-145-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-144-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-143-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-142-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-141-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-140-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-139-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-138-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-137-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-136-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-135-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2432-134-0x0000020776290000-0x00000207762900F8-memory.dmp

                                                                                                                                    memory/2608-253-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-248-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-236-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-237-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-238-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-239-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-240-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-241-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-242-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-243-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-244-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-245-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-246-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-247-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-233-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-249-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-250-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-251-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-235-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-252-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-260-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-255-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-256-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-258-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-259-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-254-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-261-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-263-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-264-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-265-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-266-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-267-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-231-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-268-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-262-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-257-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-232-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2608-234-0x000002193BAA0000-0x000002193BAA00F8-memory.dmp

                                                                                                                                    memory/2656-110-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-107-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-57-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-120-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-119-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-111-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-118-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-117-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-116-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-58-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-97-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-115-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-122-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-131-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-114-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-55-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-130-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-129-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-128-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-98-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-99-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-113-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-127-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-126-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-125-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-124-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-123-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-101-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-100-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-103-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-104-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-105-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-106-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-121-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-108-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-109-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-102-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/2656-112-0x00000281432F0000-0x00000281432F00F8-memory.dmp

                                                                                                                                    memory/3600-366-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-355-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-370-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-358-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-351-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-334-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-335-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-333-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-368-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-367-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-365-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-364-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-363-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-362-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-361-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-360-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-359-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-357-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-356-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-369-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-354-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-353-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-352-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-350-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-349-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-348-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-347-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-346-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-345-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-344-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-336-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-337-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-338-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-339-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-340-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-341-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-342-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/3600-343-0x00000231497F0000-0x00000231497F00F8-memory.dmp

                                                                                                                                    memory/4656-67-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-82-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-60-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-61-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-62-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-64-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-68-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-74-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-87-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-95-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-94-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-93-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-92-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-91-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-90-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-89-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-88-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-86-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-85-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-84-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-83-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-59-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-81-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-80-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-79-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-78-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-77-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-76-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-75-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-73-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-72-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-71-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-70-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-69-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-66-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-65-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-63-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp

                                                                                                                                    memory/4656-54-0x0000018F1FA80000-0x0000018F1FA800F8-memory.dmp