Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26/12/2020, 11:38

General

  • Target
    SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.exe
  • Size 986KB
  • Sample201226-qpcc9747bn
  • SHA256 ca3ee4fd6ee1ac062b9120a3aebea22568bf1271c9894ec4914b9c29bbf1c853
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Kills process with taskkill 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2554 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Rasftuby.Gen.14.10239.27368.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Windows\SYSTEM32\TASKKILL.exe
        TASKKILL /F /IM chrome.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2924
      • C:\Windows\regedit.exe
        regedit /s chrome.reg
        3⤵
        • Runs .reg file with regedit
        PID:216
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c chrome64.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1332
        • C:\Windows\system32\mshta.exe
          mshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1516
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\chrome64.bat" h"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:860
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:/Program Files/Google/Chrome/Application/chrome.exe"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2068
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffb926e6e00,0x7ffb926e6e10,0x7ffb926e6e20
                7⤵
                  PID:3840
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1528 /prefetch:2
                  7⤵
                    PID:4020
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1816 /prefetch:8
                    7⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1068
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 /prefetch:8
                    7⤵
                      PID:4092
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
                      7⤵
                        PID:508
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2972 /prefetch:1
                        7⤵
                          PID:4016
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3368 /prefetch:8
                          7⤵
                            PID:3024
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
                            7⤵
                              PID:3768
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
                              7⤵
                                PID:4112
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
                                7⤵
                                  PID:4160
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
                                  7⤵
                                    PID:4184
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4168 /prefetch:8
                                    7⤵
                                      PID:4232
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4504 /prefetch:8
                                      7⤵
                                        PID:4356
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4512 /prefetch:8
                                        7⤵
                                          PID:4412
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5036 /prefetch:8
                                          7⤵
                                            PID:4576
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4392 /prefetch:8
                                            7⤵
                                              PID:4860
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
                                              7⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4916
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3432 /prefetch:8
                                              7⤵
                                                PID:4968
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8
                                                7⤵
                                                  PID:5000
                                                • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                  "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
                                                  7⤵
                                                    PID:5036
                                                    • C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
                                                      "C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6ea747740,0x7ff6ea747750,0x7ff6ea747760
                                                      8⤵
                                                        PID:5088
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:8
                                                      7⤵
                                                        PID:5060
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5328 /prefetch:8
                                                        7⤵
                                                          PID:1760
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5408 /prefetch:8
                                                          7⤵
                                                            PID:4872
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
                                                            7⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4444
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5424 /prefetch:8
                                                            7⤵
                                                              PID:4584
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:8
                                                              7⤵
                                                                PID:4240
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5632 /prefetch:8
                                                                7⤵
                                                                  PID:3044
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4668 /prefetch:8
                                                                  7⤵
                                                                    PID:4024
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:8
                                                                    7⤵
                                                                      PID:4060
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5072 /prefetch:8
                                                                      7⤵
                                                                        PID:2900
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5076 /prefetch:8
                                                                        7⤵
                                                                          PID:4824
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5908 /prefetch:8
                                                                          7⤵
                                                                            PID:4788
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6140 /prefetch:8
                                                                            7⤵
                                                                              PID:4892
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6260 /prefetch:8
                                                                              7⤵
                                                                                PID:5048
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6132 /prefetch:8
                                                                                7⤵
                                                                                  PID:1216
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6504 /prefetch:8
                                                                                  7⤵
                                                                                    PID:5024
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6508 /prefetch:8
                                                                                    7⤵
                                                                                      PID:4900
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5380 /prefetch:8
                                                                                      7⤵
                                                                                        PID:5100
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6884 /prefetch:8
                                                                                        7⤵
                                                                                          PID:5004
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
                                                                                          7⤵
                                                                                            PID:5040
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5624 /prefetch:8
                                                                                            7⤵
                                                                                              PID:1760
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:8
                                                                                              7⤵
                                                                                                PID:4580
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7312 /prefetch:8
                                                                                                7⤵
                                                                                                  PID:4428
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:8
                                                                                                  7⤵
                                                                                                    PID:3508
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4836 /prefetch:8
                                                                                                    7⤵
                                                                                                      PID:2072
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4272 /prefetch:8
                                                                                                      7⤵
                                                                                                        PID:4408
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4288 /prefetch:8
                                                                                                        7⤵
                                                                                                          PID:5116
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7832 /prefetch:8
                                                                                                          7⤵
                                                                                                            PID:5072
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                                                                                                            7⤵
                                                                                                              PID:4320
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8068 /prefetch:8
                                                                                                              7⤵
                                                                                                                PID:4664
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8352 /prefetch:8
                                                                                                                7⤵
                                                                                                                  PID:4932
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8472 /prefetch:8
                                                                                                                  7⤵
                                                                                                                    PID:4812
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8168 /prefetch:8
                                                                                                                    7⤵
                                                                                                                      PID:2124
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
                                                                                                                      7⤵
                                                                                                                        PID:4384
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6280 /prefetch:8
                                                                                                                        7⤵
                                                                                                                          PID:4120
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6124 /prefetch:8
                                                                                                                          7⤵
                                                                                                                            PID:4940
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5848 /prefetch:8
                                                                                                                            7⤵
                                                                                                                              PID:4192
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5936 /prefetch:8
                                                                                                                              7⤵
                                                                                                                                PID:4824
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3796 /prefetch:8
                                                                                                                                7⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:4396
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7364 /prefetch:8
                                                                                                                                7⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:4512
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:8
                                                                                                                                7⤵
                                                                                                                                  PID:4292
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
                                                                                                                                  7⤵
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  PID:4576
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
                                                                                                                                  7⤵
                                                                                                                                    PID:1344
                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\87.250.200\software_reporter_tool.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\87.250.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=tqV8MW36ZQndk7RiIYou0Mt7OX+zxpSa6ZRRlG2f --registry-suffix=ESET --srt-field-trial-group-name=NewCleanerUIExperiment
                                                                                                                                    7⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:5008
                                                                                                                                    • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\87.250.200\software_reporter_tool.exe
                                                                                                                                      "c:\users\admin\appdata\local\google\chrome\user data\swreporter\87.250.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=87.250.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff78728ea60,0x7ff78728ea70,0x7ff78728ea80
                                                                                                                                      8⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4956
                                                                                                                                    • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\87.250.200\software_reporter_tool.exe
                                                                                                                                      "c:\users\admin\appdata\local\google\chrome\user data\swreporter\87.250.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5008_KNHKWJAMFGSRLRVJ" --sandboxed-process-id=2 --init-done-notifier=700 --sandbox-mojo-pipe-token=9927208776158729518 --mojo-platform-channel-handle=676 --engine=2
                                                                                                                                      8⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4224
                                                                                                                                    • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\87.250.200\software_reporter_tool.exe
                                                                                                                                      "c:\users\admin\appdata\local\google\chrome\user data\swreporter\87.250.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_5008_KNHKWJAMFGSRLRVJ" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=17234183233749531924 --mojo-platform-channel-handle=912
                                                                                                                                      8⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:196
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
                                                                                                                                    7⤵
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:4136
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1028 /prefetch:8
                                                                                                                                    7⤵
                                                                                                                                      PID:4560
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
                                                                                                                                      7⤵
                                                                                                                                        PID:4836
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:8
                                                                                                                                        7⤵
                                                                                                                                          PID:4100
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1516,5026047229563896636,17663061655684692531,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1492 /prefetch:2
                                                                                                                                          7⤵
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          PID:5012
                                                                                                                                • C:\Windows\regedit.exe
                                                                                                                                  regedit /s chrome-set.reg
                                                                                                                                  3⤵
                                                                                                                                  • Runs .reg file with regedit
                                                                                                                                  PID:4216

                                                                                                                            Network

                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  memory/3768-79-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-81-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-76-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-83-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-55-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-85-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-86-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-88-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-61-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-62-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-63-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-65-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-64-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-67-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-66-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-68-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-69-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-70-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-71-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-72-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-73-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-74-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-75-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-77-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-78-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-80-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-82-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-84-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-87-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-90-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-97-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-96-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-95-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-94-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-93-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-92-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-91-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/3768-89-0x000002ADCB710000-0x000002ADCB7100F8-memory.dmp

                                                                                                                                  memory/4020-24-0x00007FFBA07C0000-0x00007FFBA07C1000-memory.dmp

                                                                                                                                  memory/4112-206-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-198-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-188-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-181-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-180-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-183-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-184-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-58-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-185-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-186-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-187-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-189-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-190-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-191-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-192-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-195-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-193-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-194-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-196-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-197-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-179-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-199-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-200-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-201-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-202-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-203-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-205-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-182-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-207-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-208-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-209-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-175-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-176-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-177-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-178-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-210-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-211-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4112-204-0x000002149DED0000-0x000002149DED00F8-memory.dmp

                                                                                                                                  memory/4160-154-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-150-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-153-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-158-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-163-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-168-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-173-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-147-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-144-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-142-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-140-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-139-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-137-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-172-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-171-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-170-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-169-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-167-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-166-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-165-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-164-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-162-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-161-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-160-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-159-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-157-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-156-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-155-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-152-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-151-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-149-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-148-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-146-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-145-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-143-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-141-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-138-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4160-57-0x0000017781210000-0x00000177812100F8-memory.dmp

                                                                                                                                  memory/4184-108-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-102-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-134-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-133-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-132-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-131-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-130-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-129-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-128-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-127-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-126-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-125-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-121-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-122-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-123-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-124-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-120-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-119-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-115-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-116-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-117-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-118-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-114-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-113-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-112-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-111-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-110-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-109-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-107-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-106-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-56-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-99-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-135-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-100-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-101-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-105-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-103-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4184-104-0x0000014A09900000-0x0000014A099000F8-memory.dmp

                                                                                                                                  memory/4224-424-0x00007FFB9E660000-0x00007FFB9E661000-memory.dmp

                                                                                                                                  memory/4224-423-0x00007FFBA0190000-0x00007FFBA0191000-memory.dmp

                                                                                                                                  memory/4320-364-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-355-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-365-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-369-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-349-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-361-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-351-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-363-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-371-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-359-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-358-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-360-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-362-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-357-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-370-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-366-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-352-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-354-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-335-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-356-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-353-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-350-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-348-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-334-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-347-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-346-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-367-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-345-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-344-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-336-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-368-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-343-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-342-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-341-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-337-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-338-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-339-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4320-340-0x000001B318600000-0x000001B3186000F8-memory.dmp

                                                                                                                                  memory/4384-403-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-378-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-407-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-408-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-409-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-410-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-406-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-397-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-396-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-395-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-394-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-393-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-392-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-391-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-390-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-389-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-388-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-387-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-386-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-385-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-384-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-383-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-382-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-381-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-405-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-373-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-404-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-400-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-399-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-398-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-402-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-374-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-375-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-380-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-379-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-401-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-377-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/4384-376-0x0000016027110000-0x00000160271100F8-memory.dmp

                                                                                                                                  memory/5040-299-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-316-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-330-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-329-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-327-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-325-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-326-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-324-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-323-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-322-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-321-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-320-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-319-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-300-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-318-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-309-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-314-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-315-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-313-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-312-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-311-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-328-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-331-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-310-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-317-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-301-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-308-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-302-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-303-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-304-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-306-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-307-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-305-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-298-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-297-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-295-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-296-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp

                                                                                                                                  memory/5040-332-0x000001C1456F0000-0x000001C1456F00F8-memory.dmp