http://imbe09.s3.au-syd.cloud-object-storage.appdomain.cloud/macadamizer/login.html

General
Target

http://imbe09.s3.au-syd.cloud-object-storage.appdomain.cloud/macadamizer/login.html

Filesize

N/A

Completed

27-07-2021 21:11

Score
8 /10
Malware Config
Signatures 9

Filter: none

Collection
Credential Access
Discovery
  • Executes dropped EXE
    software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

    Reported IOCs

    pidprocess
    4540software_reporter_tool.exe
    4828software_reporter_tool.exe
    5360software_reporter_tool.exe
    4724software_reporter_tool.exe
  • Loads dropped DLL
    software_reporter_tool.exe

    Reported IOCs

    pidprocess
    5360software_reporter_tool.exe
    5360software_reporter_tool.exe
    5360software_reporter_tool.exe
    5360software_reporter_tool.exe
    5360software_reporter_tool.exe
    5360software_reporter_tool.exe
    5360software_reporter_tool.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Enumerates system info in registry
    chrome.exe

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturerchrome.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductNamechrome.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSchrome.exe
  • Suspicious behavior: EnumeratesProcesses
    chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exesoftware_reporter_tool.exe

    Reported IOCs

    pidprocess
    3460chrome.exe
    3460chrome.exe
    3920chrome.exe
    3920chrome.exe
    4900chrome.exe
    4900chrome.exe
    5064chrome.exe
    5064chrome.exe
    5812chrome.exe
    5812chrome.exe
    5864chrome.exe
    5864chrome.exe
    5920chrome.exe
    5920chrome.exe
    5036chrome.exe
    5036chrome.exe
    5036chrome.exe
    5036chrome.exe
    5524chrome.exe
    5524chrome.exe
    4540software_reporter_tool.exe
    4540software_reporter_tool.exe
  • Suspicious use of AdjustPrivilegeToken
    software_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exesoftware_reporter_tool.exe

    Reported IOCs

    descriptionpidprocess
    Token: 334828software_reporter_tool.exe
    Token: SeIncBasePriorityPrivilege4828software_reporter_tool.exe
    Token: 334540software_reporter_tool.exe
    Token: SeIncBasePriorityPrivilege4540software_reporter_tool.exe
    Token: 335360software_reporter_tool.exe
    Token: SeIncBasePriorityPrivilege5360software_reporter_tool.exe
    Token: 334724software_reporter_tool.exe
    Token: SeIncBasePriorityPrivilege4724software_reporter_tool.exe
  • Suspicious use of FindShellTrayWindow
    chrome.exe

    Reported IOCs

    pidprocess
    3920chrome.exe
    3920chrome.exe
    3920chrome.exe
  • Suspicious use of WriteProcessMemory
    chrome.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3920 wrote to memory of 5883920chrome.exechrome.exe
    PID 3920 wrote to memory of 5883920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 37683920chrome.exechrome.exe
    PID 3920 wrote to memory of 34603920chrome.exechrome.exe
    PID 3920 wrote to memory of 34603920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
    PID 3920 wrote to memory of 30803920chrome.exechrome.exe
Processes 79
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" http://imbe09.s3.au-syd.cloud-object-storage.appdomain.cloud/macadamizer/login.html
    Enumerates system info in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of FindShellTrayWindow
    Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xa4,0xdc,0x7ff982c44f50,0x7ff982c44f60,0x7ff982c44f70
      PID:588
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1688 /prefetch:2
      PID:3768
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1764 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:3460
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2140 /prefetch:8
      PID:3080
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2496 /prefetch:1
      PID:4088
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
      PID:3328
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2504 /prefetch:1
      PID:1684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
      PID:4108
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      PID:4164
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
      PID:4224
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5224 /prefetch:8
      PID:4688
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5240 /prefetch:8
      PID:4820
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5616 /prefetch:8
      PID:4848
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:4900
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5612 /prefetch:8
      PID:4980
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5588 /prefetch:8
      PID:5044
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:8
      PID:5096
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6032 /prefetch:8
      PID:4152
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6028 /prefetch:8
      PID:4328
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5740 /prefetch:8
      PID:736
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6292 /prefetch:8
      PID:4692
    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings
      PID:4892
      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe
        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff7ad5ba890,0x7ff7ad5ba8a0,0x7ff7ad5ba8b0
        PID:4908
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7060 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:5064
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7160 /prefetch:8
      PID:5048
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6984 /prefetch:8
      PID:4104
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7036 /prefetch:8
      PID:5036
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7012 /prefetch:8
      PID:4536
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6952 /prefetch:8
      PID:476
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6972 /prefetch:8
      PID:4900
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6520 /prefetch:8
      PID:4896
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5612 /prefetch:8
      PID:2876
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6164 /prefetch:8
      PID:4512
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6296 /prefetch:8
      PID:4872
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:8
      PID:2356
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
      PID:4848
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5776 /prefetch:8
      PID:2040
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7280 /prefetch:8
      PID:3944
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5604 /prefetch:8
      PID:4308
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7548 /prefetch:8
      PID:5020
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7424 /prefetch:8
      PID:5116
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7808 /prefetch:8
      PID:4856
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7936 /prefetch:8
      PID:2184
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8064 /prefetch:8
      PID:4540
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8184 /prefetch:8
      PID:5072
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8060 /prefetch:8
      PID:5144
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8348 /prefetch:8
      PID:5196
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8568 /prefetch:8
      PID:5244
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8616 /prefetch:8
      PID:5296
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8728 /prefetch:8
      PID:5356
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8988 /prefetch:8
      PID:5400
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8076 /prefetch:1
      PID:5512
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
      PID:5596
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
      PID:5684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1568 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:5812
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:5864
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:5920
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1932 /prefetch:8
      PID:5980
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4216 /prefetch:8
      PID:6032
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5012 /prefetch:8
      PID:6092
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:8
      PID:5152
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:8
      PID:5352
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:8
      PID:5392
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2380 /prefetch:2
      Suspicious behavior: EnumeratesProcesses
      PID:5036
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5016 /prefetch:8
      PID:5108
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2372 /prefetch:8
      PID:4516
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2380 /prefetch:8
      PID:4120
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5264 /prefetch:8
      PID:2876
    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe
      "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\91.266.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=2SYcvGjx2Iya4hnBrneyXbUltnMv9rq5dqorFcAu --registry-suffix=ESET --srt-field-trial-group-name=Off
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4540
      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe
        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=91.266.200 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff6e1613270,0x7ff6e1613280,0x7ff6e1613290
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        PID:4828
      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe
        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4540_XLLBZFXWXJJIEYFR" --sandboxed-process-id=2 --init-done-notifier=692 --sandbox-mojo-pipe-token=3905725523581047314 --mojo-platform-channel-handle=668 --engine=2
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        PID:5360
      • \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe
        "c:\users\admin\appdata\local\google\chrome\user data\swreporter\91.266.200\software_reporter_tool.exe" --use-crash-handler-with-id="\\.\pipe\crashpad_4540_XLLBZFXWXJJIEYFR" --sandboxed-process-id=3 --init-done-notifier=916 --sandbox-mojo-pipe-token=1377592816435056577 --mojo-platform-channel-handle=912
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        PID:4724
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
      Suspicious behavior: EnumeratesProcesses
      PID:5524
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5116 /prefetch:8
      PID:5604
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4276 /prefetch:8
      PID:5432
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1356 /prefetch:8
      PID:5184
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4056 /prefetch:8
      PID:4240
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,3740232696560250746,8950498345310696570,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6260 /prefetch:8
      PID:4416
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                      MD5

                      885a435513e58cc14dd9ceaa6d1acc8c

                      SHA1

                      6018df65b8d7eca522988c3420332a1d4b1f6654

                      SHA256

                      3c630c85d0e1ccaa217e69013b0cd20a28a956b33ffe86d9781d39ee99416483

                      SHA512

                      ba436e3618fa8fd950f9d312386342d657633aac0b38bd85250062873f491fdae8f5ca12835fc1e221d15af58173740f02d86137705d048301aac6e9a40b7645

                    • \??\pipe\crashpad_3920_ARVYTQSCWHGEWZJR

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • \??\pipe\crashpad_4892_UYILFMLMJWEJBHJB

                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                    • memory/476-260-0x0000000000000000-mapping.dmp

                    • memory/588-116-0x0000000000000000-mapping.dmp

                    • memory/736-222-0x0000000000000000-mapping.dmp

                    • memory/1684-140-0x0000000000000000-mapping.dmp

                    • memory/2040-302-0x0000000000000000-mapping.dmp

                    • memory/2184-332-0x0000000000000000-mapping.dmp

                    • memory/2356-292-0x0000000000000000-mapping.dmp

                    • memory/2876-277-0x0000000000000000-mapping.dmp

                    • memory/3080-127-0x0000000000000000-mapping.dmp

                    • memory/3328-145-0x0000000000000000-mapping.dmp

                    • memory/3460-122-0x0000000000000000-mapping.dmp

                    • memory/3768-123-0x00007FF98C450000-0x00007FF98C451000-memory.dmp

                    • memory/3768-121-0x0000000000000000-mapping.dmp

                    • memory/3944-307-0x0000000000000000-mapping.dmp

                    • memory/4088-133-0x0000000000000000-mapping.dmp

                    • memory/4104-245-0x0000000000000000-mapping.dmp

                    • memory/4108-150-0x0000000000000000-mapping.dmp

                    • memory/4152-212-0x0000000000000000-mapping.dmp

                    • memory/4164-157-0x0000000000000000-mapping.dmp

                    • memory/4224-163-0x0000000000000000-mapping.dmp

                    • memory/4308-312-0x0000000000000000-mapping.dmp

                    • memory/4328-217-0x0000000000000000-mapping.dmp

                    • memory/4512-282-0x0000000000000000-mapping.dmp

                    • memory/4536-255-0x0000000000000000-mapping.dmp

                    • memory/4540-335-0x0000000000000000-mapping.dmp

                    • memory/4688-179-0x0000000000000000-mapping.dmp

                    • memory/4692-227-0x0000000000000000-mapping.dmp

                    • memory/4820-184-0x0000000000000000-mapping.dmp

                    • memory/4848-297-0x0000000000000000-mapping.dmp

                    • memory/4848-189-0x0000000000000000-mapping.dmp

                    • memory/4856-327-0x0000000000000000-mapping.dmp

                    • memory/4872-287-0x0000000000000000-mapping.dmp

                    • memory/4892-231-0x0000000000000000-mapping.dmp

                    • memory/4896-272-0x0000000000000000-mapping.dmp

                    • memory/4900-267-0x0000000000000000-mapping.dmp

                    • memory/4900-193-0x0000000000000000-mapping.dmp

                    • memory/4908-234-0x0000000000000000-mapping.dmp

                    • memory/4980-197-0x0000000000000000-mapping.dmp

                    • memory/5020-315-0x0000000000000000-mapping.dmp

                    • memory/5036-252-0x0000000000000000-mapping.dmp

                    • memory/5036-436-0x0000000000000000-mapping.dmp

                    • memory/5044-202-0x0000000000000000-mapping.dmp

                    • memory/5048-242-0x0000000000000000-mapping.dmp

                    • memory/5064-238-0x0000000000000000-mapping.dmp

                    • memory/5072-342-0x0000000000000000-mapping.dmp

                    • memory/5096-207-0x0000000000000000-mapping.dmp

                    • memory/5116-322-0x0000000000000000-mapping.dmp

                    • memory/5144-347-0x0000000000000000-mapping.dmp

                    • memory/5152-422-0x0000000000000000-mapping.dmp

                    • memory/5196-351-0x0000000000000000-mapping.dmp

                    • memory/5244-356-0x0000000000000000-mapping.dmp

                    • memory/5296-361-0x0000000000000000-mapping.dmp

                    • memory/5352-427-0x0000000000000000-mapping.dmp

                    • memory/5356-367-0x0000000000000000-mapping.dmp

                    • memory/5360-466-0x00007FF98E1F0000-0x00007FF98E1F1000-memory.dmp

                    • memory/5360-467-0x00007FF98C610000-0x00007FF98C611000-memory.dmp

                    • memory/5360-493-0x0000015B80260000-0x0000015B802A0000-memory.dmp

                    • memory/5392-432-0x0000000000000000-mapping.dmp

                    • memory/5400-370-0x0000000000000000-mapping.dmp

                    • memory/5512-377-0x0000000000000000-mapping.dmp

                    • memory/5596-384-0x0000000000000000-mapping.dmp

                    • memory/5684-391-0x0000000000000000-mapping.dmp

                    • memory/5812-397-0x0000000000000000-mapping.dmp

                    • memory/5864-400-0x0000000000000000-mapping.dmp

                    • memory/5920-403-0x0000000000000000-mapping.dmp

                    • memory/5980-407-0x0000000000000000-mapping.dmp

                    • memory/6032-412-0x0000000000000000-mapping.dmp

                    • memory/6092-417-0x0000000000000000-mapping.dmp