masslogger | 08a9b841c509bb0171f6899c3357e6b2cc47ce64e352315c4a8aaa4961ad0673

Analysis

max time kernel
150s
max time network
144s
platform
windows10_x64
resource
win10v20201028
submitted
13-01-2021 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
Size

718KB
MD5

44d0f64678ae63a17b6c535d60f7dd47
SHA1

ea9e2a939d111c57b1a1da10805433e46c86e485
SHA256

08a9b841c509bb0171f6899c3357e6b2cc47ce64e352315c4a8aaa4961ad0673
SHA512

93ef6d531f676cfb6072618c21760af48b9722b3e571eaa580270dd54e5a65c7bc120d04dd3e2f90543e7d8acf7aa2061930275d9f73d13633c968819f0250ad

Score

10^/10

masslogger spyware stealer

Malware Config

Signatures

MassLogger
Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
stealer spyware masslogger

MassLogger Main Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3380-12-0x0000000000400000-0x0000000000486000-memory.dmp	family_masslogger
behavioral2/memory/3380-13-0x0000000000481E9E-mapping.dmp	family_masslogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 api.ipify.org

flow	ioc
10	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

description	pid	process	target process
PID 3636 set thread context of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

pid process

3380 Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe

pid	process
3380	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
3380	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
3380	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
3380	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
1748	chrome.exe
1748	chrome.exe
1336	chrome.exe
1336	chrome.exe
4924	chrome.exe
4924	chrome.exe
4748	chrome.exe
4748	chrome.exe
4708	chrome.exe
4708	chrome.exe
4772	chrome.exe
4772	chrome.exe
4960	chrome.exe
4960	chrome.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

description pid process

Token: SeDebugPrivilege 3380 Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

chrome.exe

pid process

1336 chrome.exe
1336 chrome.exe
1336 chrome.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

pid process

3380 Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

description	pid	process
Token: SeDebugPrivilege	3380	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe

pid	process
1336	chrome.exe
1336	chrome.exe
1336	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exechrome.exe

description	pid	process	target process
PID 3636 wrote to memory of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
PID 3636 wrote to memory of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
PID 3636 wrote to memory of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
PID 3636 wrote to memory of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
PID 3636 wrote to memory of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
PID 3636 wrote to memory of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
PID 3636 wrote to memory of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
PID 3636 wrote to memory of 3380	3636	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe	Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
PID 1336 wrote to memory of 1648	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 1648	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3076	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 1748	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 1748	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe
PID 1336 wrote to memory of 3620	1336	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3636

C:\Users\Admin\AppData\Local\Temp\Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\Our New Order Jan 11 2020 at 2.30_PVV440_PDF.exe"
2⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff8ea186e00,0x7ff8ea186e10,0x7ff8ea186e20
2⤵
PID:1648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1468 /prefetch:2
2⤵
PID:3076

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1784 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 /prefetch:8
2⤵
PID:3620

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:1
2⤵
PID:2276

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:1
2⤵
PID:2188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
2⤵
PID:3660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:1
2⤵
PID:1496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
2⤵
PID:740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
2⤵
PID:1772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4356 /prefetch:8
2⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4488 /prefetch:8
2⤵
PID:4268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4832 /prefetch:8
2⤵
PID:4312

C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
2⤵
PID:4360

C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff60d977740,0x7ff60d977750,0x7ff60d977760
3⤵
PID:4416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
2⤵
PID:4352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:8
2⤵
PID:4388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4824 /prefetch:8
2⤵
PID:4508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5260 /prefetch:8
2⤵
PID:4568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
PID:4616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:8
2⤵
PID:4656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4656 /prefetch:8
2⤵
PID:4692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4856 /prefetch:8
2⤵
PID:4192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5876 /prefetch:8
2⤵
PID:4788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5308 /prefetch:8
2⤵
PID:4848

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:8
2⤵
PID:4896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4704 /prefetch:8
2⤵
PID:4912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
PID:4944

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6404 /prefetch:8
2⤵
PID:5032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4864 /prefetch:8
2⤵
PID:4196

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6056 /prefetch:8
2⤵
PID:5080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5900 /prefetch:8
2⤵
PID:4288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6600 /prefetch:8
2⤵
PID:4324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:8
2⤵
PID:4404

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
2⤵
PID:4336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6412 /prefetch:8
2⤵
PID:4500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6708 /prefetch:8
2⤵
PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7040 /prefetch:8
2⤵
PID:4460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7160 /prefetch:8
2⤵
PID:4552

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:8
2⤵
PID:4632

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5484 /prefetch:8
2⤵
PID:4720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7220 /prefetch:8
2⤵
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:8
2⤵
PID:4764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7476 /prefetch:1
2⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7416 /prefetch:8
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7424 /prefetch:8
2⤵
PID:4936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7920 /prefetch:8
2⤵
PID:4208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6428 /prefetch:8
2⤵
PID:5068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8088 /prefetch:1
2⤵
PID:4328

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8080 /prefetch:8
2⤵
PID:4420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8348 /prefetch:8
2⤵
PID:4532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8472 /prefetch:8
2⤵
PID:4356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8672 /prefetch:8
2⤵
PID:3624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6456 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 /prefetch:8
2⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1456,12614429572264204608,9894329266636678648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 /prefetch:8
2⤵
PID:1228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
MD5
74833fbefe4fabdb4ecdc59eed9ebf03

SHA1
4894e9ba3d8e2f478325e9bcd93fafca32df1522

SHA256
a2ac1e5b25979591d547623b4e0103440207eb11d388fac5f6976cd53d237f09

SHA512
1b61717e0df87d5215b41f9ad187f033f25aead97b1a6dd2444521a6d33097fcc4f2812a8e33d85958003a183ece71543e081e9944412880dee0150bd0c94802

Download Submit
\??\pipe\crashpad_1336_FKRPOAEHFPZBELEY
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/740-174-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-168-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-177-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-178-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-179-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-180-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-163-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-182-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-183-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-185-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-186-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-187-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-188-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-175-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-189-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-190-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-191-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-193-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-181-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-176-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-162-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-194-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-195-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-40-0x0000000000000000-mapping.dmp

Download
memory/740-196-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-197-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-199-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-198-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-184-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-172-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-173-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-171-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-170-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-169-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-192-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-167-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-166-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-165-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/740-164-0x0000023151340000-0x00000231513400F8-memory.dmp

Filesize
248B

Download
memory/1228-367-0x0000000000000000-mapping.dmp

Download
memory/1496-139-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-38-0x0000000000000000-mapping.dmp

Download
memory/1496-158-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-157-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-156-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-155-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-154-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-153-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-152-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-150-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-125-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-133-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-141-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-151-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-160-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-149-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-148-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-147-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-146-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-145-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-144-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-159-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-143-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-142-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-140-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-123-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-138-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-137-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-124-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-136-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-135-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-134-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-132-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-131-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-130-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-129-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-128-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-127-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1496-126-0x000001CE55AE0000-0x000001CE55AE00F8-memory.dmp

Filesize
248B

Download
memory/1648-23-0x0000000000000000-mapping.dmp

Download
memory/1748-26-0x0000000000000000-mapping.dmp

Download
memory/1772-92-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-97-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-114-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-109-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-103-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-100-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-119-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-84-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-85-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-86-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-87-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-88-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-89-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-90-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-91-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-93-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-94-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-95-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-96-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-121-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-98-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-99-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-101-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-102-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-104-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-105-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-106-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-36-0x0000000000000000-mapping.dmp

Download
memory/1772-120-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-107-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-108-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-110-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-111-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-112-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-113-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-115-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-116-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-117-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/1772-118-0x000002172B150000-0x000002172B1500F8-memory.dmp

Filesize
248B

Download
memory/2188-32-0x0000000000000000-mapping.dmp

Download
memory/2276-222-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-230-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-202-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-204-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-206-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-205-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-207-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-208-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-209-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-210-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-211-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-212-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-220-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-219-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-224-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-227-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-31-0x0000000000000000-mapping.dmp

Download
memory/2276-203-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-233-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-213-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-214-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-215-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-216-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-217-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-218-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-221-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-223-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-225-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-226-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-237-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-228-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-229-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-231-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-232-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-234-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-235-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-236-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/2276-238-0x000001F569E00000-0x000001F569E000F8-memory.dmp

Filesize
248B

Download
memory/3076-27-0x00007FF903C60000-0x00007FF903C61000-memory.dmp

Filesize
4KB

Download
memory/3076-25-0x0000000000000000-mapping.dmp

Download
memory/3380-14-0x0000000073BA0000-0x000000007428E000-memory.dmp

Filesize
6.9MB

Download
memory/3380-12-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/3380-21-0x0000000006C30000-0x0000000006C31000-memory.dmp

Filesize
4KB

Download
memory/3380-19-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download
memory/3380-13-0x0000000000481E9E-mapping.dmp

Download
memory/3620-29-0x0000000000000000-mapping.dmp

Download
memory/3624-321-0x0000000000000000-mapping.dmp

Download
memory/3636-8-0x0000000007F70000-0x000000000801E000-memory.dmp

Filesize
696KB

Download
memory/3636-2-0x0000000073BA0000-0x000000007428E000-memory.dmp

Filesize
6.9MB

Download
memory/3636-3-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/3636-11-0x0000000004FA0000-0x0000000004FAF000-memory.dmp

Filesize
60KB

Download
memory/3636-10-0x0000000008410000-0x0000000008411000-memory.dmp

Filesize
4KB

Download
memory/3636-9-0x0000000008020000-0x0000000008021000-memory.dmp

Filesize
4KB

Download
memory/3636-5-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/3636-6-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/3636-7-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/3660-74-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-60-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-64-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-65-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-66-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-67-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-68-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-69-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-70-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-71-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-72-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-73-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-75-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-76-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-77-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-63-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-78-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-79-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-80-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-81-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-82-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-61-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-62-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-35-0x0000000000000000-mapping.dmp

Download
memory/3660-59-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-58-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-57-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-56-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-55-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-54-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-45-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-46-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-47-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-48-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-49-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-50-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-51-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-52-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/3660-53-0x000001896B070000-0x000001896B0700F8-memory.dmp

Filesize
248B

Download
memory/4192-260-0x0000000000000000-mapping.dmp

Download
memory/4192-43-0x0000000000000000-mapping.dmp

Download
memory/4196-275-0x0000000000000000-mapping.dmp

Download
memory/4208-309-0x0000000000000000-mapping.dmp

Download
memory/4268-240-0x0000000000000000-mapping.dmp

Download
memory/4288-279-0x0000000000000000-mapping.dmp

Download
memory/4312-242-0x0000000000000000-mapping.dmp

Download
memory/4324-281-0x0000000000000000-mapping.dmp

Download
memory/4328-342-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-350-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-360-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-357-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-359-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-358-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-356-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-355-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-354-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-328-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-353-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-352-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-329-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-330-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-331-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-351-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-332-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-333-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-349-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-334-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-337-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-338-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-348-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-347-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-340-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-341-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-343-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-344-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-345-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-346-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-339-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-313-0x0000000000000000-mapping.dmp

Download
memory/4328-336-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-335-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-327-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-323-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-324-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-325-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4328-326-0x00000241F0400000-0x00000241F04000F8-memory.dmp

Filesize
248B

Download
memory/4336-285-0x0000000000000000-mapping.dmp

Download
memory/4352-245-0x0000000000000000-mapping.dmp

Download
memory/4356-319-0x0000000000000000-mapping.dmp

Download
memory/4360-244-0x0000000000000000-mapping.dmp

Download
memory/4364-364-0x0000000000000000-mapping.dmp

Download
memory/4388-247-0x0000000000000000-mapping.dmp

Download
memory/4404-283-0x0000000000000000-mapping.dmp

Download
memory/4416-249-0x0000000000000000-mapping.dmp

Download
memory/4420-314-0x0000000000000000-mapping.dmp

Download
memory/4460-291-0x0000000000000000-mapping.dmp

Download
memory/4500-286-0x0000000000000000-mapping.dmp

Download
memory/4508-250-0x0000000000000000-mapping.dmp

Download
memory/4532-317-0x0000000000000000-mapping.dmp

Download
memory/4552-293-0x0000000000000000-mapping.dmp

Download
memory/4568-252-0x0000000000000000-mapping.dmp

Download
memory/4580-289-0x0000000000000000-mapping.dmp

Download
memory/4612-299-0x0000000000000000-mapping.dmp

Download
memory/4616-254-0x0000000000000000-mapping.dmp

Download
memory/4632-295-0x0000000000000000-mapping.dmp

Download
memory/4656-256-0x0000000000000000-mapping.dmp

Download
memory/4692-258-0x0000000000000000-mapping.dmp

Download
memory/4708-362-0x0000000000000000-mapping.dmp

Download
memory/4720-297-0x0000000000000000-mapping.dmp

Download
memory/4748-261-0x0000000000000000-mapping.dmp

Download
memory/4764-301-0x0000000000000000-mapping.dmp

Download
memory/4772-363-0x0000000000000000-mapping.dmp

Download
memory/4788-263-0x0000000000000000-mapping.dmp

Download
memory/4848-265-0x0000000000000000-mapping.dmp

Download
memory/4856-304-0x0000000000000000-mapping.dmp

Download
memory/4896-267-0x0000000000000000-mapping.dmp

Download
memory/4900-303-0x0000000000000000-mapping.dmp

Download
memory/4912-269-0x0000000000000000-mapping.dmp

Download
memory/4924-201-0x0000000000000000-mapping.dmp

Download
memory/4936-307-0x0000000000000000-mapping.dmp

Download
memory/4944-271-0x0000000000000000-mapping.dmp

Download
memory/4960-366-0x0000000000000000-mapping.dmp

Download
memory/5032-273-0x0000000000000000-mapping.dmp

Download
memory/5068-311-0x0000000000000000-mapping.dmp

Download
memory/5080-277-0x0000000000000000-mapping.dmp

Download