Overview

overview

10

Static

static

setup_x86_...ll.exe

windows7_x64

8

setup_x86_...ll.exe

windows10_x64

10

Analysis

  • max time kernel
    96s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    25-06-2021 00:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install.exe

Score
10/10
elysiumstealerfickerstealergluptebametasploitredlinesmokeloadervidar706865932servaniaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealerthemidatrojanupx

Malware Config

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://ppcspb.com/upload/

http://mebbing.com/upload/

http://twcamel.com/upload/

http://howdycash.com/upload/

http://lahuertasonora.com/upload/

http://kpotiques.com/upload/
rc4.i32
rc4.i32

Extracted

Family

vidar

Version

39.4

Botnet

932

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    932

Extracted

Family

vidar

Version

39.4

Botnet

865

C2

https://sergeevih43.tumblr.com

Attributes
  • profile_id

    865

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

fickerstealer

C2

bukkva.club:80

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 11 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 6 IoCs
    stealer
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 43 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 16 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Kills process with taskkill 6 IoCs
    evasion
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
    1⤵
      PID:2512
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2748
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2728
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2696
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2520
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1888
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1392
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1300
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1160
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1088
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:1000
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:1016
                        • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
                          "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:568
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3864
                            • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:3560
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c arnatic_1.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3520
                                • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_1.exe
                                  arnatic_1.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:1964
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_1.exe" & del C:\ProgramData\*.dll & exit
                                    6⤵
                                      PID:5460
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im arnatic_1.exe /f
                                        7⤵
                                        • Kills process with taskkill
                                        PID:2300
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        7⤵
                                        • Delays execution with timeout.exe
                                        PID:5900
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c arnatic_2.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3840
                                  • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_2.exe
                                    arnatic_2.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:188
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c arnatic_3.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:796
                                  • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_3.exe
                                    arnatic_3.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:572
                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                      6⤵
                                      • Loads dropped DLL
                                      • Modifies registry class
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:3864
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c arnatic_4.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2324
                                  • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_4.exe
                                    arnatic_4.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2804
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4004
                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4784
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c arnatic_5.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1792
                                  • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_5.exe
                                    arnatic_5.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:3144
                                    • C:\Users\Admin\AppData\Roaming\3021591.exe
                                      "C:\Users\Admin\AppData\Roaming\3021591.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:2244
                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5076
                                    • C:\Users\Admin\AppData\Roaming\4304137.exe
                                      "C:\Users\Admin\AppData\Roaming\4304137.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4192
                                    • C:\Users\Admin\AppData\Roaming\4888416.exe
                                      "C:\Users\Admin\AppData\Roaming\4888416.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:2816
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -u -p 2816 -s 936
                                        7⤵
                                        • Program crash
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4956
                                    • C:\Users\Admin\AppData\Roaming\6563883.exe
                                      "C:\Users\Admin\AppData\Roaming\6563883.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4472
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c arnatic_6.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2792
                                  • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_6.exe
                                    arnatic_6.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    PID:1212
                                    • C:\Users\Admin\Documents\dQClg78HInQ_selZSqJc0W3u.exe
                                      "C:\Users\Admin\Documents\dQClg78HInQ_selZSqJc0W3u.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4336
                                      • C:\Users\Admin\Documents\dQClg78HInQ_selZSqJc0W3u.exe
                                        C:\Users\Admin\Documents\dQClg78HInQ_selZSqJc0W3u.exe
                                        7⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4752
                                    • C:\Users\Admin\Documents\ixt8235ff05UuUKtILr089mY.exe
                                      "C:\Users\Admin\Documents\ixt8235ff05UuUKtILr089mY.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4372
                                    • C:\Users\Admin\Documents\XQ7HLOx5suxTcctm8juUX7t7.exe
                                      "C:\Users\Admin\Documents\XQ7HLOx5suxTcctm8juUX7t7.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3756
                                    • C:\Users\Admin\Documents\URoIB22XlTtJ3_RfERwLxnO6.exe
                                      "C:\Users\Admin\Documents\URoIB22XlTtJ3_RfERwLxnO6.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4356
                                    • C:\Users\Admin\Documents\u91qtaa5aWeCVAOWOuqANWEm.exe
                                      "C:\Users\Admin\Documents\u91qtaa5aWeCVAOWOuqANWEm.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks processor information in registry
                                      PID:4332
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c taskkill /im u91qtaa5aWeCVAOWOuqANWEm.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\u91qtaa5aWeCVAOWOuqANWEm.exe" & del C:\ProgramData\*.dll & exit
                                        7⤵
                                          PID:5428
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            taskkill /im u91qtaa5aWeCVAOWOuqANWEm.exe /f
                                            8⤵
                                            • Kills process with taskkill
                                            PID:5564
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout /t 6
                                            8⤵
                                            • Delays execution with timeout.exe
                                            PID:5648
                                      • C:\Users\Admin\Documents\TLyHBUXlWss5uVByEA2ptxyt.exe
                                        "C:\Users\Admin\Documents\TLyHBUXlWss5uVByEA2ptxyt.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks processor information in registry
                                        PID:4240
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /im TLyHBUXlWss5uVByEA2ptxyt.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\TLyHBUXlWss5uVByEA2ptxyt.exe" & del C:\ProgramData\*.dll & exit
                                          7⤵
                                            PID:5332
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /im TLyHBUXlWss5uVByEA2ptxyt.exe /f
                                              8⤵
                                              • Kills process with taskkill
                                              PID:4448
                                            • C:\Windows\SysWOW64\timeout.exe
                                              timeout /t 6
                                              8⤵
                                              • Delays execution with timeout.exe
                                              PID:5544
                                        • C:\Users\Admin\Documents\tTsdDT87_rNUDrpw7umbrovY.exe
                                          "C:\Users\Admin\Documents\tTsdDT87_rNUDrpw7umbrovY.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:4116
                                          • C:\Users\Admin\Documents\tTsdDT87_rNUDrpw7umbrovY.exe
                                            "C:\Users\Admin\Documents\tTsdDT87_rNUDrpw7umbrovY.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Checks SCSI registry key(s)
                                            • Suspicious behavior: MapViewOfSection
                                            PID:2540
                                        • C:\Users\Admin\Documents\DUtqm3WWMjU9d0UD1CR3mA2d.exe
                                          "C:\Users\Admin\Documents\DUtqm3WWMjU9d0UD1CR3mA2d.exe"
                                          6⤵
                                          • Executes dropped EXE
                                          PID:4432
                                          • C:\Users\Admin\Documents\DUtqm3WWMjU9d0UD1CR3mA2d.exe
                                            "C:\Users\Admin\Documents\DUtqm3WWMjU9d0UD1CR3mA2d.exe"
                                            7⤵
                                              PID:632
                                          • C:\Users\Admin\Documents\HgPqKPXPDAP4gowzmM1gdKCU.exe
                                            "C:\Users\Admin\Documents\HgPqKPXPDAP4gowzmM1gdKCU.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4268
                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              7⤵
                                              • Executes dropped EXE
                                              PID:2476
                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              7⤵
                                              • Executes dropped EXE
                                              PID:4844
                                          • C:\Users\Admin\Documents\QMdFCoVzwvZP1QL0C8J_maBX.exe
                                            "C:\Users\Admin\Documents\QMdFCoVzwvZP1QL0C8J_maBX.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4880
                                            • C:\Users\Admin\Documents\QMdFCoVzwvZP1QL0C8J_maBX.exe
                                              "C:\Users\Admin\Documents\QMdFCoVzwvZP1QL0C8J_maBX.exe"
                                              7⤵
                                                PID:5368
                                            • C:\Users\Admin\Documents\YJEQyD5WfhtpyFcAstalXmBC.exe
                                              "C:\Users\Admin\Documents\YJEQyD5WfhtpyFcAstalXmBC.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              • Modifies registry class
                                              PID:5004
                                              • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                                                7⤵
                                                • Loads dropped DLL
                                                • Modifies registry class
                                                PID:4004
                                            • C:\Users\Admin\Documents\8cLrtK9ICHez05pPsHIbuXkI.exe
                                              "C:\Users\Admin\Documents\8cLrtK9ICHez05pPsHIbuXkI.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3864
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                7⤵
                                                  PID:3808
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                    8⤵
                                                      PID:5536
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                    7⤵
                                                      PID:6124
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb48b24f50,0x7ffb48b24f60,0x7ffb48b24f70
                                                        8⤵
                                                          PID:6108
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:2
                                                          8⤵
                                                            PID:5916
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1736 /prefetch:8
                                                            8⤵
                                                              PID:888
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 /prefetch:8
                                                              8⤵
                                                                PID:4548
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
                                                                8⤵
                                                                  PID:5156
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
                                                                  8⤵
                                                                    PID:5820
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
                                                                    8⤵
                                                                      PID:5832
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
                                                                      8⤵
                                                                        PID:4728
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
                                                                        8⤵
                                                                          PID:5236
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
                                                                          8⤵
                                                                            PID:5856
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:8
                                                                            8⤵
                                                                              PID:5776
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1516,13728855961775227431,15964827914768127133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:8
                                                                              8⤵
                                                                                PID:4120
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
                                                                                8⤵
                                                                                  PID:4152
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "cmd.exe" /C taskkill /F /PID 3864 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\8cLrtK9ICHez05pPsHIbuXkI.exe"
                                                                                7⤵
                                                                                  PID:5532
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    taskkill /F /PID 3864
                                                                                    8⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:4004
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "cmd.exe" /C taskkill /F /PID 3864 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\8cLrtK9ICHez05pPsHIbuXkI.exe"
                                                                                  7⤵
                                                                                    PID:4076
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      taskkill /F /PID 3864
                                                                                      8⤵
                                                                                      • Kills process with taskkill
                                                                                      PID:5240
                                                                                • C:\Users\Admin\Documents\DabqhERZbkep1ABSXX7PfcYt.exe
                                                                                  "C:\Users\Admin\Documents\DabqhERZbkep1ABSXX7PfcYt.exe"
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  PID:5028
                                                                                  • C:\Program Files (x86)\Company\NewProduct\file4.exe
                                                                                    "C:\Program Files (x86)\Company\NewProduct\file4.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:4112
                                                                                  • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                                                                                    "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:4556
                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1504
                                                                                    • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                      8⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:5292
                                                                                  • C:\Program Files (x86)\Company\NewProduct\jingzhang.exe
                                                                                    "C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks computer location settings
                                                                                    • Modifies registry class
                                                                                    PID:4860
                                                                                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl
                                                                                      8⤵
                                                                                      • Loads dropped DLL
                                                                                      • Modifies registry class
                                                                                      PID:5548
                                                                                  • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Checks whether UAC is enabled
                                                                                    • Drops file in Program Files directory
                                                                                    PID:2972
                                                                                • C:\Users\Admin\Documents\SWbmO5IkbTy4xAkpHmyfR4Lk.exe
                                                                                  "C:\Users\Admin\Documents\SWbmO5IkbTy4xAkpHmyfR4Lk.exe"
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:4996
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\73521837292.exe"
                                                                                    7⤵
                                                                                      PID:5752
                                                                                      • C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\73521837292.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\73521837292.exe"
                                                                                        8⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        PID:5016
                                                                                        • C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\73521837292.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\73521837292.exe"
                                                                                          9⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:5688
                                                                                          • C:\Users\Admin\AppData\Local\Temp\1624589673975.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\1624589673975.exe"
                                                                                            10⤵
                                                                                              PID:5268
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\36905128145.exe" /mix
                                                                                        7⤵
                                                                                          PID:5856
                                                                                          • C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\36905128145.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\36905128145.exe" /mix
                                                                                            8⤵
                                                                                              PID:4140
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\ukNNObgiGD & timeout 3 & del /f /q "C:\Users\Admin\AppData\Local\Temp\{bkLP-Xd3JW-os31-zRE4v}\36905128145.exe"
                                                                                                9⤵
                                                                                                  PID:5928
                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                    timeout 3
                                                                                                    10⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:4816
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im "SWbmO5IkbTy4xAkpHmyfR4Lk.exe" /f & erase "C:\Users\Admin\Documents\SWbmO5IkbTy4xAkpHmyfR4Lk.exe" & exit
                                                                                              7⤵
                                                                                                PID:5468
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  taskkill /im "SWbmO5IkbTy4xAkpHmyfR4Lk.exe" /f
                                                                                                  8⤵
                                                                                                  • Kills process with taskkill
                                                                                                  PID:5744
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                                                          4⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2772
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_7.exe
                                                                                            arnatic_7.exe
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3324
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_7.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\7zS81F9B444\arnatic_7.exe
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2852
                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                    1⤵
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4016
                                                                                    • C:\Windows\system32\svchost.exe
                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                      2⤵
                                                                                      • Drops file in System32 directory
                                                                                      • Checks processor information in registry
                                                                                      • Modifies data under HKEY_USERS
                                                                                      • Modifies registry class
                                                                                      PID:3456
                                                                                  • \??\c:\windows\system32\svchost.exe
                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                    1⤵
                                                                                      PID:4172
                                                                                    • C:\Users\Admin\AppData\Local\Temp\5FCF.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\5FCF.exe
                                                                                      1⤵
                                                                                        PID:5772
                                                                                      • C:\Users\Admin\AppData\Local\Temp\64E1.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\64E1.exe
                                                                                        1⤵
                                                                                          PID:5504
                                                                                        • C:\Users\Admin\AppData\Local\Temp\6B1C.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\6B1C.exe
                                                                                          1⤵
                                                                                            PID:4156
                                                                                          • C:\Users\Admin\AppData\Local\Temp\6F24.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\6F24.exe
                                                                                            1⤵
                                                                                              PID:4104
                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff673dda890,0x7ff673dda8a0,0x7ff673dda8b0
                                                                                              1⤵
                                                                                                PID:5084
                                                                                              • C:\Users\Admin\AppData\Local\Temp\83C6.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\83C6.exe
                                                                                                1⤵
                                                                                                  PID:4260
                                                                                                • C:\Users\Admin\AppData\Local\Temp\87FD.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\87FD.exe
                                                                                                  1⤵
                                                                                                    PID:2052
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\8B2B.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\8B2B.exe
                                                                                                    1⤵
                                                                                                      PID:5372
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\93C7.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\93C7.exe
                                                                                                      1⤵
                                                                                                        PID:5496
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\9D3E.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\9D3E.exe
                                                                                                        1⤵
                                                                                                          PID:3172
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          C:\Windows\SysWOW64\explorer.exe
                                                                                                          1⤵
                                                                                                            PID:6048
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            C:\Windows\explorer.exe
                                                                                                            1⤵
                                                                                                              PID:4944
                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                              C:\Windows\SysWOW64\explorer.exe
                                                                                                              1⤵
                                                                                                                PID:5068
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                C:\Windows\explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:2484
                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:5752

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • memory/188-315-0x0000000000900000-0x00000000009AE000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    696KB

                                                                                                                    Download

                                                                                                                  • memory/188-316-0x0000000000400000-0x00000000008F4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    5.0MB

                                                                                                                    Download

                                                                                                                  • memory/1000-252-0x000002CF77680000-0x000002CF776F1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/1016-202-0x000001B505AA0000-0x000001B505B11000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/1088-239-0x0000017E96E40000-0x0000017E96EB1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/1160-282-0x0000022DF75D0000-0x0000022DF7641000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/1300-274-0x000001C147140000-0x000001C1471B1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/1392-270-0x000002735DE80000-0x000002735DEF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/1888-279-0x000001E87A760000-0x000001E87A7D1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/1964-322-0x0000000000400000-0x0000000000949000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    5.3MB

                                                                                                                    Download

                                                                                                                  • memory/1964-321-0x0000000002460000-0x00000000024FD000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    628KB

                                                                                                                    Download

                                                                                                                  • memory/2244-242-0x00000000027C0000-0x00000000027D0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                    Download

                                                                                                                  • memory/2244-229-0x0000000001000000-0x0000000001001000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2244-206-0x0000000000680000-0x0000000000681000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2244-260-0x0000000002850000-0x0000000002851000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2244-246-0x00000000078A0000-0x00000000078A1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2244-255-0x0000000007440000-0x0000000007441000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2512-231-0x000002BC06040000-0x000002BC060B1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/2520-218-0x00000219941D0000-0x0000021994241000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/2540-342-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    48KB

                                                                                                                    Download

                                                                                                                  • memory/2696-221-0x000002BE73F00000-0x000002BE73F71000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/2728-283-0x0000014AF8940000-0x0000014AF89B1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/2748-284-0x000002AD03380000-0x000002AD033F1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/2816-244-0x00000000008B0000-0x00000000008B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                    Download

                                                                                                                  • memory/2816-201-0x0000000000300000-0x0000000000301000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2852-237-0x0000000004F80000-0x0000000004F81000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2852-212-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    120KB

                                                                                                                    Download

                                                                                                                  • memory/2852-253-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2852-240-0x00000000055A0000-0x00000000055A1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2852-265-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2852-249-0x0000000004E40000-0x0000000004E41000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/2988-328-0x0000000000BD0000-0x0000000000BE6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    88KB

                                                                                                                    Download

                                                                                                                  • memory/3144-166-0x0000000000E20000-0x0000000000E21000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/3144-168-0x0000000001270000-0x0000000001271000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/3144-174-0x000000001BC20000-0x000000001BC22000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                    Download

                                                                                                                  • memory/3144-171-0x0000000001280000-0x000000000129F000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    124KB

                                                                                                                    Download

                                                                                                                  • memory/3144-172-0x00000000012A0000-0x00000000012A1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/3324-169-0x0000000000440000-0x0000000000441000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/3456-335-0x000001CBE2500000-0x000001CBE2606000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.0MB

                                                                                                                    Download

                                                                                                                  • memory/3456-250-0x000001CBDFD00000-0x000001CBDFD71000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/3456-334-0x000001CBE1560000-0x000001CBE157B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    108KB

                                                                                                                    Download

                                                                                                                  • memory/3560-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    572KB

                                                                                                                    Download

                                                                                                                  • memory/3560-145-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    100KB

                                                                                                                    Download

                                                                                                                  • memory/3560-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    100KB

                                                                                                                    Download

                                                                                                                  • memory/3560-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    152KB

                                                                                                                    Download

                                                                                                                  • memory/3560-142-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    100KB

                                                                                                                    Download

                                                                                                                  • memory/3560-133-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.1MB

                                                                                                                    Download

                                                                                                                  • memory/3560-143-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    100KB

                                                                                                                    Download

                                                                                                                  • memory/3560-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.5MB

                                                                                                                    Download

                                                                                                                  • memory/3756-320-0x0000000077CE0000-0x0000000077E6E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.6MB

                                                                                                                    Download

                                                                                                                  • memory/3756-324-0x00000000052F0000-0x00000000052F1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/3864-181-0x00000000043E8000-0x00000000044E9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.0MB

                                                                                                                    Download

                                                                                                                  • memory/3864-352-0x00000000026B0000-0x000000000273E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    568KB

                                                                                                                    Download

                                                                                                                  • memory/3864-182-0x0000000004550000-0x00000000045AD000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    372KB

                                                                                                                    Download

                                                                                                                  • memory/4016-207-0x000002AF7F3C0000-0x000002AF7F431000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    452KB

                                                                                                                    Download

                                                                                                                  • memory/4016-200-0x000002AF7F300000-0x000002AF7F34C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    304KB

                                                                                                                    Download

                                                                                                                  • memory/4116-338-0x0000000000900000-0x0000000000A4A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.3MB

                                                                                                                    Download

                                                                                                                  • memory/4192-208-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4192-241-0x0000000003090000-0x00000000030D4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    272KB

                                                                                                                    Download

                                                                                                                  • memory/4192-254-0x0000000002F30000-0x0000000002F31000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4192-227-0x0000000001750000-0x0000000001751000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4192-280-0x0000000001760000-0x0000000001761000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4240-343-0x0000000000400000-0x000000000094A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    5.3MB

                                                                                                                    Download

                                                                                                                  • memory/4240-339-0x0000000002560000-0x00000000025FD000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    628KB

                                                                                                                    Download

                                                                                                                  • memory/4332-341-0x0000000000400000-0x0000000000949000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    5.3MB

                                                                                                                    Download

                                                                                                                  • memory/4332-340-0x00000000025F0000-0x000000000268D000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    628KB

                                                                                                                    Download

                                                                                                                  • memory/4356-319-0x0000000077CE0000-0x0000000077E6E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.6MB

                                                                                                                    Download

                                                                                                                  • memory/4356-323-0x00000000055B0000-0x00000000055B1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4372-317-0x0000000005140000-0x0000000005141000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4432-345-0x0000000000400000-0x0000000000D41000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    9.3MB

                                                                                                                    Download

                                                                                                                  • memory/4432-344-0x0000000002E40000-0x0000000003766000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    9.1MB

                                                                                                                    Download

                                                                                                                  • memory/4472-238-0x0000000000540000-0x0000000000541000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4472-251-0x0000000000C80000-0x0000000000C81000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4472-275-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4472-269-0x0000000004D00000-0x0000000004D3E000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    248KB

                                                                                                                    Download

                                                                                                                  • memory/4472-271-0x0000000004E50000-0x0000000004E51000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download

                                                                                                                  • memory/4752-329-0x0000000004E30000-0x0000000005436000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    6.0MB

                                                                                                                    Download

                                                                                                                  • memory/5076-318-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                    Download