Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    17-01-2022 04:48

General

  • Target

    36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a.exe

  • Size

    278KB

  • MD5

    a661accf35159458f2b3f2f236840fa4

  • SHA1

    cf1e9a1324320ccb44b128ba0f248dfd8143adfd

  • SHA256

    36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a

  • SHA512

    b56233170ca2433de6fe7c914a0ea28e40ba410239b01725ba357f347cbdfc58658ae44ad1914a088ed7d28dbd101791323bb59a00fafc533216548b8345f9d9

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a.exe
    "C:\Users\Admin\AppData\Local\Temp\36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2696
    • C:\Users\Admin\AppData\Local\Temp\36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a.exe
      "C:\Users\Admin\AppData\Local\Temp\36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2096
  • C:\Users\Admin\AppData\Local\Temp\F703.exe
    C:\Users\Admin\AppData\Local\Temp\F703.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:3288
  • C:\Users\Admin\AppData\Local\Temp\FC15.exe
    C:\Users\Admin\AppData\Local\Temp\FC15.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Users\Admin\AppData\Local\Temp\FC15.exe
      C:\Users\Admin\AppData\Local\Temp\FC15.exe
      2⤵
      • Executes dropped EXE
      PID:1600
  • C:\Users\Admin\AppData\Local\Temp\194.exe
    C:\Users\Admin\AppData\Local\Temp\194.exe
    1⤵
    • Executes dropped EXE
    PID:1072
  • C:\Users\Admin\AppData\Local\Temp\4C2.exe
    C:\Users\Admin\AppData\Local\Temp\4C2.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qvdfezzm\
      2⤵
        PID:356
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dsysndbq.exe" C:\Windows\SysWOW64\qvdfezzm\
        2⤵
          PID:1244
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create qvdfezzm binPath= "C:\Windows\SysWOW64\qvdfezzm\dsysndbq.exe /d\"C:\Users\Admin\AppData\Local\Temp\4C2.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2964
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description qvdfezzm "wifi internet conection"
            2⤵
              PID:1648
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start qvdfezzm
              2⤵
                PID:2108
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2228
              • C:\Users\Admin\AppData\Local\Temp\6A7.exe
                C:\Users\Admin\AppData\Local\Temp\6A7.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:680
                • C:\Users\Admin\AppData\Local\Temp\6A7.exe
                  C:\Users\Admin\AppData\Local\Temp\6A7.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2008
              • C:\Windows\SysWOW64\qvdfezzm\dsysndbq.exe
                C:\Windows\SysWOW64\qvdfezzm\dsysndbq.exe /d"C:\Users\Admin\AppData\Local\Temp\4C2.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4072
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2312
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2696
              • C:\Users\Admin\AppData\Local\Temp\686F.exe
                C:\Users\Admin\AppData\Local\Temp\686F.exe
                1⤵
                • Executes dropped EXE
                PID:416
              • C:\Users\Admin\AppData\Local\Temp\6DCF.exe
                C:\Users\Admin\AppData\Local\Temp\6DCF.exe
                1⤵
                • Executes dropped EXE
                PID:2600
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                • Accesses Microsoft Outlook profiles
                • outlook_office_path
                • outlook_win_path
                PID:64
              • C:\Users\Admin\AppData\Local\Temp\7E6A.exe
                C:\Users\Admin\AppData\Local\Temp\7E6A.exe
                1⤵
                • Executes dropped EXE
                PID:1252
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 404
                  2⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2224
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:1196
                • C:\Users\Admin\AppData\Local\Temp\88CC.exe
                  C:\Users\Admin\AppData\Local\Temp\88CC.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2964
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 404
                    2⤵
                    • Program crash
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1304
                • C:\Users\Admin\AppData\Local\Temp\9197.exe
                  C:\Users\Admin\AppData\Local\Temp\9197.exe
                  1⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:4004
                  • C:\Windows\system32\Robocopy.exe
                    "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup"
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3040
                  • C:\Windows\system32\Robocopy.exe
                    "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default"
                    2⤵
                      PID:3752
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --silent-launch --mute-audio --load-extension="C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup"
                      2⤵
                      • Enumerates system info in registry
                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                      PID:2156
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ff9f1604f50,0x7ff9f1604f60,0x7ff9f1604f70
                        3⤵
                          PID:2028
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
                          3⤵
                            PID:2600
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2572 /prefetch:1
                            3⤵
                              PID:1592
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=2220 /prefetch:8
                              3⤵
                                PID:2180
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=network --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=1696 /prefetch:8
                                3⤵
                                  PID:1752
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1648 /prefetch:2
                                  3⤵
                                    PID:2488
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=3972 /prefetch:8
                                    3⤵
                                      PID:928
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4516 /prefetch:1
                                      3⤵
                                        PID:4228
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4664 /prefetch:8
                                        3⤵
                                          PID:4272
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4832 /prefetch:8
                                          3⤵
                                            PID:4304
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4836 /prefetch:8
                                            3⤵
                                              PID:4376
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4824 /prefetch:8
                                              3⤵
                                                PID:4412
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4360 /prefetch:8
                                                3⤵
                                                  PID:4444
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4224 /prefetch:8
                                                  3⤵
                                                    PID:4476
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4316 /prefetch:8
                                                    3⤵
                                                      PID:4484
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5000 /prefetch:8
                                                      3⤵
                                                        PID:4552
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5080 /prefetch:8
                                                        3⤵
                                                          PID:4584
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4212 /prefetch:8
                                                          3⤵
                                                            PID:4620
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                                                            3⤵
                                                              PID:4656
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=audio --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4788 /prefetch:8
                                                              3⤵
                                                                PID:4728
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
                                                                3⤵
                                                                  PID:4808
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                                                  3⤵
                                                                    PID:4892
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4924 /prefetch:8
                                                                    3⤵
                                                                      PID:4976
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5456 /prefetch:8
                                                                      3⤵
                                                                        PID:5028
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5484 /prefetch:8
                                                                        3⤵
                                                                          PID:5068
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=652 /prefetch:8
                                                                          3⤵
                                                                            PID:4164
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1636,5147188528384432121,15370711890437777584,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4820 /prefetch:8
                                                                            3⤵
                                                                              PID:4292
                                                                        • C:\Users\Admin\AppData\Roaming\ebdbvdf
                                                                          C:\Users\Admin\AppData\Roaming\ebdbvdf
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:4100
                                                                          • C:\Users\Admin\AppData\Roaming\ebdbvdf
                                                                            C:\Users\Admin\AppData\Roaming\ebdbvdf
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Checks SCSI registry key(s)
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            PID:4152
                                                                        • C:\Users\Admin\AppData\Roaming\fadbvdf
                                                                          C:\Users\Admin\AppData\Roaming\fadbvdf
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          PID:2136
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2136 -s 476
                                                                            2⤵
                                                                            • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                            • Program crash
                                                                            PID:4192

                                                                        Network

                                                                        MITRE ATT&CK Matrix ATT&CK v6

                                                                        Persistence

                                                                        New Service

                                                                        1
                                                                        T1050

                                                                        Modify Existing Service

                                                                        1
                                                                        T1031

                                                                        Registry Run Keys / Startup Folder

                                                                        2
                                                                        T1060

                                                                        Privilege Escalation

                                                                        New Service

                                                                        1
                                                                        T1050

                                                                        Defense Evasion

                                                                        Disabling Security Tools

                                                                        1
                                                                        T1089

                                                                        Modify Registry

                                                                        3
                                                                        T1112

                                                                        Credential Access

                                                                        Credentials in Files

                                                                        2
                                                                        T1081

                                                                        Discovery

                                                                        Query Registry

                                                                        3
                                                                        T1012

                                                                        System Information Discovery

                                                                        3
                                                                        T1082

                                                                        Peripheral Device Discovery

                                                                        1
                                                                        T1120

                                                                        Collection

                                                                        Data from Local System

                                                                        2
                                                                        T1005

                                                                        Email Collection

                                                                        1
                                                                        T1114

                                                                        Command and Control

                                                                        Web Service

                                                                        1
                                                                        T1102

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\CrashpadMetrics-active.pma
                                                                          MD5

                                                                          03c4f648043a88675a920425d824e1b3

                                                                          SHA1

                                                                          b98ce64ab5f7a187d19deb8f24ca4ab5d9720a6d

                                                                          SHA256

                                                                          f91dbb7c64b4582f529c968c480d2dce1c8727390482f31e4355a27bb3d9b450

                                                                          SHA512

                                                                          2473f21cf8747ec981db18fb42726c767bbcca8dd89fd05ffd2d844206a6e86da672967462ac714e6fb43cc84ac35fffcec7ddc43a9357c1f8ed9d14105e9192

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Crashpad\settings.dat
                                                                          MD5

                                                                          defd4b4c01dc63e9cf87c57dc5ed0a0f

                                                                          SHA1

                                                                          15fd4530afb9f4909b1507ad407c596ec01b706d

                                                                          SHA256

                                                                          cbe322d27841339076deb836e59a80c36698a18f63bf3b3aa3c138449c92800d

                                                                          SHA512

                                                                          7a77936004277e3bf6370067dd0b8b0af31a5702dd01ddca0817983a0be73847de56bc1877fb46574b370cf595821ab674e6ee0482791f07873a5ef5725642a2

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Cookies
                                                                          MD5

                                                                          055c8c5c47424f3c2e7a6fc2ee904032

                                                                          SHA1

                                                                          5952781d22cff35d94861fac25d89a39af6d0a87

                                                                          SHA256

                                                                          531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

                                                                          SHA512

                                                                          c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Favicons
                                                                          MD5

                                                                          5688ce73407154729a65e71e4123ab21

                                                                          SHA1

                                                                          9a2bb4125d44f996af3ed51a71ee6f8ecd296bd7

                                                                          SHA256

                                                                          be1b822e970dfe1a120d248db7000eaf799bd6531929a1308676c70fe1608d60

                                                                          SHA512

                                                                          eb6452b23ea36c39d03ead154185616c13583f12f382cb2456beeb1ba6e5febdfd2a6f1064283cf115ad1c517dbf409777cdacb128e00c9d3f401335db355537

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\History
                                                                          MD5

                                                                          4e2922249bf476fb3067795f2fa5e794

                                                                          SHA1

                                                                          d2db6b2759d9e650ae031eb62247d457ccaa57d2

                                                                          SHA256

                                                                          c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

                                                                          SHA512

                                                                          8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Login Data
                                                                          MD5

                                                                          b608d407fc15adea97c26936bc6f03f6

                                                                          SHA1

                                                                          953e7420801c76393902c0d6bb56148947e41571

                                                                          SHA256

                                                                          b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                                                                          SHA512

                                                                          cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Media History
                                                                          MD5

                                                                          1ddfe694c682299567c25daee0cf2a04

                                                                          SHA1

                                                                          d32bb6199d95989525ce204a859780cca708142c

                                                                          SHA256

                                                                          2237a10a071315f272ac9eb9338ce9a83350739537a5cbf0f82bd5ac65e45968

                                                                          SHA512

                                                                          a1a09f7e4c919a758c38c8a789feac95dd17f07fc955ca83bd0e4af6ca053f5e205d6f55bcce380f83cbc5bd26e75457ce120fc287c13bd8b73b68e1610d11a6

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Network Persistent State
                                                                          MD5

                                                                          0b9387926f7e80ef3fb4fcb5bc09b1ca

                                                                          SHA1

                                                                          1b1f977199cc0b8b40cb72c143b5058631cf7cc3

                                                                          SHA256

                                                                          cb4ea0d0195d67826fc4a4542a1c5350c59d7ff67e452f4283a222c8d901dfbd

                                                                          SHA512

                                                                          ffa2b5fff9a104b1ecad1ce182afd0bb8567e8b85cb9e1f60454d6ad5f46b7ba7ec73d850e8c73624532a9632cd52d9c9669cc1e83b89a6f1b29125979198ca3

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Preferences
                                                                          MD5

                                                                          796ff6ab0235091a5252331251093284

                                                                          SHA1

                                                                          74381d9fd8afe12860b1ee5ff5507d9138f26103

                                                                          SHA256

                                                                          7b8e0e20bc50cffd13ffd96493c91ecd853da4bf2279592010e7271e17d9e706

                                                                          SHA512

                                                                          757de2bccbb005131569f6f7d4cbfbc38029dfe19324b50e7b173b59f5d55fb5b49a9e096b20411cc6ba0d30065b148a4012e4ea8ff952d55b5ba91ed80e731c

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Reporting and NEL
                                                                          MD5

                                                                          b5d2dfb55ed87893a11a93eefbea3c85

                                                                          SHA1

                                                                          6c94fe4817e69cd7204ccc06ef35417e9000b4d4

                                                                          SHA256

                                                                          d73c28f52de4320ffac8f2154fe5b366a1ce69784853af9d2ac8c332a5022dc1

                                                                          SHA512

                                                                          7cf0da3a3ced744b07742bc00c5a1db31a6e82c1ed866de2ae28f0421a5331efe7ceadcd39de71a3c230fc8021ee879ae32f9fd93afe8605949aa661ccbac21a

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Secure Preferences
                                                                          MD5

                                                                          cb2c3de3ee28693e511db4fb7d6a4ba9

                                                                          SHA1

                                                                          c06f64f9c7aece6dd764c990a3ee092ed35e2c65

                                                                          SHA256

                                                                          5e53ab65e64739443d6b2bd9f20951e8bf9f1b8167b4cbe13547e06f46eeebae

                                                                          SHA512

                                                                          98b63965b397a19998570da84d05b36ddd1ac10a59dc43fc20dd2b80afed711666a7c842ac071fb5ffbb733005cea7bd961ae49626c05b6c8684abbabcbb258d

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Top Sites
                                                                          MD5

                                                                          9048adc11b40da3679e854f2aaee2813

                                                                          SHA1

                                                                          3a5f63f46b6f38dc15e852bc9ec85d17b3bf09d3

                                                                          SHA256

                                                                          55f6ab81fe7167e23124f16688da2f74223d2c7b6e3312316f243f129519bc2a

                                                                          SHA512

                                                                          421477d5561ba0e55597469b01785c46ed1a3ad36f592db527290705129539c6355fc0477c219c899c253fb95b1213b1e05fef57d4d0e0b74c48a9f2cc0d3e1e

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\TransportSecurity
                                                                          MD5

                                                                          9e8c0552c470957c48df7b3a9f8ce422

                                                                          SHA1

                                                                          4e00106cdb68b82667904a18127ab82d2366dba9

                                                                          SHA256

                                                                          5414a6c90f5f2b03750a55f3954efbda6d587ec09af6e334b7fe0c8db70e92dc

                                                                          SHA512

                                                                          baabd7450d750a11ab72afa0f0f62853776f8f5ab5fe815a6c21b16ba9ffc126c353c32214a6ce0788eb49cc7116a7f4dff579d917ae22d50f1557d2117b158c

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Visited Links
                                                                          MD5

                                                                          56dcc920e3f828f6543c4cf35e8d5486

                                                                          SHA1

                                                                          79f836755c7b333ffa0101b56b747d34c23ca1ca

                                                                          SHA256

                                                                          4ed457ef398583f90cb384446cdc35f017db63d3546acded266653ad604c68b9

                                                                          SHA512

                                                                          9c2fa9dba5aaf3ef19e4ad0ca6059c99ad1ba818669772be57e5630094c01b00d38b9a12c8dcf63d370a8ef28638f5b4d6ede276463856acd9bfd7793ac5a314

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default\Web Data
                                                                          MD5

                                                                          8ee018331e95a610680a789192a9d362

                                                                          SHA1

                                                                          e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

                                                                          SHA256

                                                                          94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

                                                                          SHA512

                                                                          4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Last Version
                                                                          MD5

                                                                          b63048c4e7e52c52053d25da30d9c5ab

                                                                          SHA1

                                                                          679a44d402f5ec24605719e06459f5a707989187

                                                                          SHA256

                                                                          389caa40ea458e84bc624a9af1e0dec60fa652b2db2b81c09b1dfe22822cc3d1

                                                                          SHA512

                                                                          e86c58c5a25e24f21ad79ed526a90c120a09c115f4820663bd2ebbc59e7bb1c4c418267eb77645522aa20b2c1b53fba8e31690db7bae9b21e4eff3db06316359

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Local State
                                                                          MD5

                                                                          ada00cc173c12f43a1c91fa5c8ca75d3

                                                                          SHA1

                                                                          036e45e4aa3e71880fb298ea23e4581e11acd0c9

                                                                          SHA256

                                                                          1dc43e541961213f47871091c3ed0a9b5b6d9df62dbbf22971e253e6ed95d6b8

                                                                          SHA512

                                                                          180719f4aaa7443fea9a3d32abdc6f6c7428b1bd56997665b38d6f7ffabe839bdddeec34ebb18992203e0e8cc42a64246a68c199b63051b8ff42ebdae7bbf8c0

                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\chrome_shutdown_ms.txt
                                                                          MD5

                                                                          9b1f4ffaaa79bf4fda19a9c79f0c6818

                                                                          SHA1

                                                                          9c77fc479b61eb5fb469cd1dcd2eaf6408c9c22d

                                                                          SHA256

                                                                          0633a3f1f8df521f5eb8ef2143654b0664175cf295f3c6ddf7487ff8f9a5639f

                                                                          SHA512

                                                                          aa5487e1a082e4a038f4bc8d213ae8bbcf70a8f2ad40daf1968423a1bde6966ed9546c30eff14fcf85418917ab4ac92a61c70a6b67a18ed080e6f7e921fd6964

                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6A7.exe.log
                                                                          MD5

                                                                          41fbed686f5700fc29aaccf83e8ba7fd

                                                                          SHA1

                                                                          5271bc29538f11e42a3b600c8dc727186e912456

                                                                          SHA256

                                                                          df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                                                                          SHA512

                                                                          234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                                                                        • C:\Users\Admin\AppData\Local\Temp\194.exe
                                                                          MD5

                                                                          3cdea2e17acec208a9f5fad3ae03ade4

                                                                          SHA1

                                                                          8e50e1dafaf28a0ef825a36df5dfc42083dbe9c0

                                                                          SHA256

                                                                          33d732d1c08aca5c7b0e83bfd9c6d76520d2c71e09c090121bb1473b03fc3649

                                                                          SHA512

                                                                          5d3d2bc3178ada978775ac0e0c77ba6f4ea12cb7726ff0c0e83670fe6274ac88ecf57cb7cc14ff20856914d1d3b1862599832bc4b3b99e59fada027b65238370

                                                                        • C:\Users\Admin\AppData\Local\Temp\194.exe
                                                                          MD5

                                                                          3cdea2e17acec208a9f5fad3ae03ade4

                                                                          SHA1

                                                                          8e50e1dafaf28a0ef825a36df5dfc42083dbe9c0

                                                                          SHA256

                                                                          33d732d1c08aca5c7b0e83bfd9c6d76520d2c71e09c090121bb1473b03fc3649

                                                                          SHA512

                                                                          5d3d2bc3178ada978775ac0e0c77ba6f4ea12cb7726ff0c0e83670fe6274ac88ecf57cb7cc14ff20856914d1d3b1862599832bc4b3b99e59fada027b65238370

                                                                        • C:\Users\Admin\AppData\Local\Temp\4C2.exe
                                                                          MD5

                                                                          78eb270b621a1e3db76461757b62b42d

                                                                          SHA1

                                                                          69907df11fcda3abcd4931f9fcf3fe68ed4017b5

                                                                          SHA256

                                                                          e07b6f76311e7c7ee8e1dedb903cea42d6e2bcfd9b276d4b07413cc39623a2bc

                                                                          SHA512

                                                                          045cd0647ac1cd5483d1f5facad75dce3cc1a6671c21d7508e7cea8f7b633e09b6f22d2179d2449963fd7e2edb640024a6bec388979b6c37206065ec484d6889

                                                                        • C:\Users\Admin\AppData\Local\Temp\4C2.exe
                                                                          MD5

                                                                          78eb270b621a1e3db76461757b62b42d

                                                                          SHA1

                                                                          69907df11fcda3abcd4931f9fcf3fe68ed4017b5

                                                                          SHA256

                                                                          e07b6f76311e7c7ee8e1dedb903cea42d6e2bcfd9b276d4b07413cc39623a2bc

                                                                          SHA512

                                                                          045cd0647ac1cd5483d1f5facad75dce3cc1a6671c21d7508e7cea8f7b633e09b6f22d2179d2449963fd7e2edb640024a6bec388979b6c37206065ec484d6889

                                                                        • C:\Users\Admin\AppData\Local\Temp\686F.exe
                                                                          MD5

                                                                          5828affd59476cc9ac97334a09e8ca50

                                                                          SHA1

                                                                          4c4e16afe85a1a9a19005c90d9e4787795bce071

                                                                          SHA256

                                                                          054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                                                                          SHA512

                                                                          406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                                                                        • C:\Users\Admin\AppData\Local\Temp\686F.exe
                                                                          MD5

                                                                          5828affd59476cc9ac97334a09e8ca50

                                                                          SHA1

                                                                          4c4e16afe85a1a9a19005c90d9e4787795bce071

                                                                          SHA256

                                                                          054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                                                                          SHA512

                                                                          406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                                                                        • C:\Users\Admin\AppData\Local\Temp\6A7.exe
                                                                          MD5

                                                                          29e5d8cbcf13639096bf1353b5f9f48b

                                                                          SHA1

                                                                          800629d06593b7fb232a2dfd08384c4349f37382

                                                                          SHA256

                                                                          ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                                                          SHA512

                                                                          3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                                                                        • C:\Users\Admin\AppData\Local\Temp\6A7.exe
                                                                          MD5

                                                                          29e5d8cbcf13639096bf1353b5f9f48b

                                                                          SHA1

                                                                          800629d06593b7fb232a2dfd08384c4349f37382

                                                                          SHA256

                                                                          ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                                                          SHA512

                                                                          3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                                                                        • C:\Users\Admin\AppData\Local\Temp\6A7.exe
                                                                          MD5

                                                                          29e5d8cbcf13639096bf1353b5f9f48b

                                                                          SHA1

                                                                          800629d06593b7fb232a2dfd08384c4349f37382

                                                                          SHA256

                                                                          ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                                                                          SHA512

                                                                          3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                                                                        • C:\Users\Admin\AppData\Local\Temp\6DCF.exe
                                                                          MD5

                                                                          5828affd59476cc9ac97334a09e8ca50

                                                                          SHA1

                                                                          4c4e16afe85a1a9a19005c90d9e4787795bce071

                                                                          SHA256

                                                                          054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                                                                          SHA512

                                                                          406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                                                                        • C:\Users\Admin\AppData\Local\Temp\6DCF.exe
                                                                          MD5

                                                                          5828affd59476cc9ac97334a09e8ca50

                                                                          SHA1

                                                                          4c4e16afe85a1a9a19005c90d9e4787795bce071

                                                                          SHA256

                                                                          054a128d15144cae389f2c762127995ead7c100aa5c3e329ebb59ffda01a9cd3

                                                                          SHA512

                                                                          406f4e91b92dbd575b549fdc3b54fdfd1ea267ab2c9d03d35d66eaa56170231945fb6bef282d2d89b6045cba286a30a5aa6dbc5d5d0acfdee999c80ce54a3460

                                                                        • C:\Users\Admin\AppData\Local\Temp\7E6A.exe
                                                                          MD5

                                                                          dda320cdb60094470b148e93760105f3

                                                                          SHA1

                                                                          2dcb621aec4f844fd37c64e6eabee9f827abf93d

                                                                          SHA256

                                                                          1b7b6ef3fc21c58be4121dcd66b8e3b1231c0bb49f6e256460cc213775f4dd90

                                                                          SHA512

                                                                          9ca7350d5a228df36552bdedc1b5e35af66b01b0464592ba818c31c3beff8fa2c71bcd0e2ad2037b45c4c86577b920a21c5e35a66772c1a2b842d1afeef33e21

                                                                        • C:\Users\Admin\AppData\Local\Temp\7E6A.exe
                                                                          MD5

                                                                          dda320cdb60094470b148e93760105f3

                                                                          SHA1

                                                                          2dcb621aec4f844fd37c64e6eabee9f827abf93d

                                                                          SHA256

                                                                          1b7b6ef3fc21c58be4121dcd66b8e3b1231c0bb49f6e256460cc213775f4dd90

                                                                          SHA512

                                                                          9ca7350d5a228df36552bdedc1b5e35af66b01b0464592ba818c31c3beff8fa2c71bcd0e2ad2037b45c4c86577b920a21c5e35a66772c1a2b842d1afeef33e21

                                                                        • C:\Users\Admin\AppData\Local\Temp\88CC.exe
                                                                          MD5

                                                                          ffc7e0b51a3320c3f6d1e76163b974bd

                                                                          SHA1

                                                                          9b153961448dacf4313701ad4f10ddc82adbba27

                                                                          SHA256

                                                                          ace473f7276e62fafda41c68ea85dc99c091a644e74efea748ce5e5f38c9990b

                                                                          SHA512

                                                                          65f084bec8c8f79be79db8bed2fc4940874b473eceb5d74d1340fbd5035dff112f9af7bc9453224f064a5ef570cf3d5faf68e88e9048715c9006102a604d2cd4

                                                                        • C:\Users\Admin\AppData\Local\Temp\88CC.exe
                                                                          MD5

                                                                          ffc7e0b51a3320c3f6d1e76163b974bd

                                                                          SHA1

                                                                          9b153961448dacf4313701ad4f10ddc82adbba27

                                                                          SHA256

                                                                          ace473f7276e62fafda41c68ea85dc99c091a644e74efea748ce5e5f38c9990b

                                                                          SHA512

                                                                          65f084bec8c8f79be79db8bed2fc4940874b473eceb5d74d1340fbd5035dff112f9af7bc9453224f064a5ef570cf3d5faf68e88e9048715c9006102a604d2cd4

                                                                        • C:\Users\Admin\AppData\Local\Temp\9197.exe
                                                                          MD5

                                                                          4f2881aeadf5c7d15c3d97c0ff97c3a5

                                                                          SHA1

                                                                          fce7d6cf87b84f003ce30a07761518b5ec6af45d

                                                                          SHA256

                                                                          e0a254158cc6c05c89c71346ffbe872a8dde4e7f8571377c0eb6fcd22a8b307e

                                                                          SHA512

                                                                          fa4833a7b4dfb13217738357e7a844f09c88f44ad75cc6c0b2cb1642dba37520642d12e7ecec4b62fac0df6a987c6e6659a908149d225b61d397378e56404656

                                                                        • C:\Users\Admin\AppData\Local\Temp\9197.exe
                                                                          MD5

                                                                          4f2881aeadf5c7d15c3d97c0ff97c3a5

                                                                          SHA1

                                                                          fce7d6cf87b84f003ce30a07761518b5ec6af45d

                                                                          SHA256

                                                                          e0a254158cc6c05c89c71346ffbe872a8dde4e7f8571377c0eb6fcd22a8b307e

                                                                          SHA512

                                                                          fa4833a7b4dfb13217738357e7a844f09c88f44ad75cc6c0b2cb1642dba37520642d12e7ecec4b62fac0df6a987c6e6659a908149d225b61d397378e56404656

                                                                        • C:\Users\Admin\AppData\Local\Temp\F703.exe
                                                                          MD5

                                                                          277680bd3182eb0940bc356ff4712bef

                                                                          SHA1

                                                                          5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                                                          SHA256

                                                                          f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                                                          SHA512

                                                                          0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                                                                        • C:\Users\Admin\AppData\Local\Temp\F703.exe
                                                                          MD5

                                                                          277680bd3182eb0940bc356ff4712bef

                                                                          SHA1

                                                                          5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                                                          SHA256

                                                                          f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                                                          SHA512

                                                                          0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                                                                        • C:\Users\Admin\AppData\Local\Temp\FC15.exe
                                                                          MD5

                                                                          a661accf35159458f2b3f2f236840fa4

                                                                          SHA1

                                                                          cf1e9a1324320ccb44b128ba0f248dfd8143adfd

                                                                          SHA256

                                                                          36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a

                                                                          SHA512

                                                                          b56233170ca2433de6fe7c914a0ea28e40ba410239b01725ba357f347cbdfc58658ae44ad1914a088ed7d28dbd101791323bb59a00fafc533216548b8345f9d9

                                                                        • C:\Users\Admin\AppData\Local\Temp\FC15.exe
                                                                          MD5

                                                                          a661accf35159458f2b3f2f236840fa4

                                                                          SHA1

                                                                          cf1e9a1324320ccb44b128ba0f248dfd8143adfd

                                                                          SHA256

                                                                          36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a

                                                                          SHA512

                                                                          b56233170ca2433de6fe7c914a0ea28e40ba410239b01725ba357f347cbdfc58658ae44ad1914a088ed7d28dbd101791323bb59a00fafc533216548b8345f9d9

                                                                        • C:\Users\Admin\AppData\Local\Temp\FC15.exe
                                                                          MD5

                                                                          a661accf35159458f2b3f2f236840fa4

                                                                          SHA1

                                                                          cf1e9a1324320ccb44b128ba0f248dfd8143adfd

                                                                          SHA256

                                                                          36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a

                                                                          SHA512

                                                                          b56233170ca2433de6fe7c914a0ea28e40ba410239b01725ba357f347cbdfc58658ae44ad1914a088ed7d28dbd101791323bb59a00fafc533216548b8345f9d9

                                                                        • C:\Users\Admin\AppData\Local\Temp\dsysndbq.exe
                                                                          MD5

                                                                          d5644e8ecf8d0ae89ec314293873b8b6

                                                                          SHA1

                                                                          182367f02bbc102f93fd3d83ba6b38afd946279d

                                                                          SHA256

                                                                          eec09e57661582257aba9b65a2365a102a58f38af4d38ad7ba1c62a0542ae5e8

                                                                          SHA512

                                                                          7fc83d849df8f1f1480bfe771ebe2a54abc62758c843a605bd9847476a78d575ee137e3ecc58cef6d7d8feabab8958e292bab7abf55848d6a74a604b4cef218d

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension\background.js
                                                                          MD5

                                                                          103cae43e5b530ed2bfac7cc70f45e58

                                                                          SHA1

                                                                          2b8da05d7f0b7dea3967c5c26e04c0cf41fcaf3b

                                                                          SHA256

                                                                          3378b5a3f3c6b078d186d0ed4612f936f932628d32c832100b0ac08b7c74aed8

                                                                          SHA512

                                                                          cffeb236f52ee3cfe5aca2e62885df851620feb19cf147aefef0d99d5704b1b330f442f1832302afd931d2412030e64e0df1bbf3dc03977fd9629a0d066408c5

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension\content.js
                                                                          MD5

                                                                          cc0d3ce5118282b4690ac50077978852

                                                                          SHA1

                                                                          6706d4a28b264fabbcae51f4e6789190d429df1a

                                                                          SHA256

                                                                          452221440693c6365843c1f612ca2ff54940d5112d8d785bc15a114dfc8336ca

                                                                          SHA512

                                                                          a0afb680ff6eee3cb1a55d230a72de983cf3544aab23d8c7e467f8f3ba713f4f32156fa10b44e9d0a0e37ac2f5a88c783e9cb1788d0803d067410154765964e5

                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension\manifest.json
                                                                          MD5

                                                                          1d0aecde4e7ff6ad173d4826542c91b5

                                                                          SHA1

                                                                          d9b707164ff34ee4cf7e38fd5ebafdd53b6355be

                                                                          SHA256

                                                                          ed263293e01f68a6a5ef0e41796d325d6ae757597de66af717e68ec625115cd8

                                                                          SHA512

                                                                          c81db62efa86319bdb9a702d60fe285c08f3fd6056d59a51370f5e5b716cfc69a90e668ccc2bc640ebade8ec0f3871eb207090e49290fc8eefdd3b4cfa0b7536

                                                                        • C:\Users\Admin\AppData\Roaming\ebdbvdf
                                                                          MD5

                                                                          a661accf35159458f2b3f2f236840fa4

                                                                          SHA1

                                                                          cf1e9a1324320ccb44b128ba0f248dfd8143adfd

                                                                          SHA256

                                                                          36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a

                                                                          SHA512

                                                                          b56233170ca2433de6fe7c914a0ea28e40ba410239b01725ba357f347cbdfc58658ae44ad1914a088ed7d28dbd101791323bb59a00fafc533216548b8345f9d9

                                                                        • C:\Users\Admin\AppData\Roaming\ebdbvdf
                                                                          MD5

                                                                          a661accf35159458f2b3f2f236840fa4

                                                                          SHA1

                                                                          cf1e9a1324320ccb44b128ba0f248dfd8143adfd

                                                                          SHA256

                                                                          36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a

                                                                          SHA512

                                                                          b56233170ca2433de6fe7c914a0ea28e40ba410239b01725ba357f347cbdfc58658ae44ad1914a088ed7d28dbd101791323bb59a00fafc533216548b8345f9d9

                                                                        • C:\Users\Admin\AppData\Roaming\ebdbvdf
                                                                          MD5

                                                                          a661accf35159458f2b3f2f236840fa4

                                                                          SHA1

                                                                          cf1e9a1324320ccb44b128ba0f248dfd8143adfd

                                                                          SHA256

                                                                          36a3b931de159be46bf280edf23b9ef53644ee5b0ec372d6b52d8b823b57cc4a

                                                                          SHA512

                                                                          b56233170ca2433de6fe7c914a0ea28e40ba410239b01725ba357f347cbdfc58658ae44ad1914a088ed7d28dbd101791323bb59a00fafc533216548b8345f9d9

                                                                        • C:\Users\Admin\AppData\Roaming\fadbvdf
                                                                          MD5

                                                                          277680bd3182eb0940bc356ff4712bef

                                                                          SHA1

                                                                          5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                                                          SHA256

                                                                          f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                                                          SHA512

                                                                          0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                                                                        • C:\Users\Admin\AppData\Roaming\fadbvdf
                                                                          MD5

                                                                          277680bd3182eb0940bc356ff4712bef

                                                                          SHA1

                                                                          5995ae9d0247036cc6d3ea741e7504c913f1fb76

                                                                          SHA256

                                                                          f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                                                                          SHA512

                                                                          0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                                                                        • C:\Windows\SysWOW64\qvdfezzm\dsysndbq.exe
                                                                          MD5

                                                                          d5644e8ecf8d0ae89ec314293873b8b6

                                                                          SHA1

                                                                          182367f02bbc102f93fd3d83ba6b38afd946279d

                                                                          SHA256

                                                                          eec09e57661582257aba9b65a2365a102a58f38af4d38ad7ba1c62a0542ae5e8

                                                                          SHA512

                                                                          7fc83d849df8f1f1480bfe771ebe2a54abc62758c843a605bd9847476a78d575ee137e3ecc58cef6d7d8feabab8958e292bab7abf55848d6a74a604b4cef218d

                                                                        • \??\pipe\crashpad_2156_WOXQOCFMSWDSOIUW
                                                                          MD5

                                                                          d41d8cd98f00b204e9800998ecf8427e

                                                                          SHA1

                                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                          SHA256

                                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                          SHA512

                                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                        • memory/64-210-0x0000000000000000-mapping.dmp
                                                                        • memory/64-218-0x0000000003000000-0x000000000306B000-memory.dmp
                                                                          Filesize

                                                                          428KB

                                                                        • memory/64-217-0x0000000003070000-0x00000000030E4000-memory.dmp
                                                                          Filesize

                                                                          464KB

                                                                        • memory/356-151-0x0000000000000000-mapping.dmp
                                                                        • memory/416-211-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                          Filesize

                                                                          39.8MB

                                                                        • memory/416-207-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                          Filesize

                                                                          39.8MB

                                                                        • memory/416-208-0x00000000049A0000-0x0000000004A08000-memory.dmp
                                                                          Filesize

                                                                          416KB

                                                                        • memory/416-209-0x0000000004A10000-0x0000000004AA2000-memory.dmp
                                                                          Filesize

                                                                          584KB

                                                                        • memory/416-205-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                          Filesize

                                                                          39.8MB

                                                                        • memory/416-204-0x00000000047A0000-0x0000000004845000-memory.dmp
                                                                          Filesize

                                                                          660KB

                                                                        • memory/416-222-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                          Filesize

                                                                          39.8MB

                                                                        • memory/416-223-0x0000000004AB0000-0x0000000004AFF000-memory.dmp
                                                                          Filesize

                                                                          316KB

                                                                        • memory/416-200-0x00000000046F9000-0x0000000004779000-memory.dmp
                                                                          Filesize

                                                                          512KB

                                                                        • memory/416-197-0x0000000000000000-mapping.dmp
                                                                        • memory/416-224-0x0000000004B50000-0x0000000004BE1000-memory.dmp
                                                                          Filesize

                                                                          580KB

                                                                        • memory/416-229-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                          Filesize

                                                                          39.8MB

                                                                        • memory/680-156-0x0000000005290000-0x000000000578E000-memory.dmp
                                                                          Filesize

                                                                          5.0MB

                                                                        • memory/680-155-0x0000000004B20000-0x0000000004B21000-memory.dmp
                                                                          Filesize

                                                                          4KB

                                                                        • memory/680-154-0x0000000004D80000-0x0000000004D81000-memory.dmp
                                                                          Filesize

                                                                          4KB

                                                                        • memory/680-150-0x0000000004BA0000-0x0000000004BBE000-memory.dmp
                                                                          Filesize

                                                                          120KB

                                                                        • memory/680-149-0x0000000004BC0000-0x0000000004C36000-memory.dmp
                                                                          Filesize

                                                                          472KB

                                                                        • memory/680-141-0x0000000000000000-mapping.dmp
                                                                        • memory/680-147-0x0000000000350000-0x00000000003DA000-memory.dmp
                                                                          Filesize

                                                                          552KB

                                                                        • memory/680-146-0x0000000000350000-0x00000000003DA000-memory.dmp
                                                                          Filesize

                                                                          552KB

                                                                        • memory/1072-134-0x0000000000000000-mapping.dmp
                                                                        • memory/1072-144-0x0000000000630000-0x00000000006DE000-memory.dmp
                                                                          Filesize

                                                                          696KB

                                                                        • memory/1072-145-0x0000000000400000-0x00000000005D0000-memory.dmp
                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/1148-152-0x0000000000620000-0x0000000000633000-memory.dmp
                                                                          Filesize

                                                                          76KB

                                                                        • memory/1148-137-0x0000000000000000-mapping.dmp
                                                                        • memory/1148-148-0x0000000000836000-0x0000000000847000-memory.dmp
                                                                          Filesize

                                                                          68KB

                                                                        • memory/1148-153-0x0000000000400000-0x00000000005CF000-memory.dmp
                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/1196-216-0x0000000000000000-mapping.dmp
                                                                        • memory/1196-221-0x00000000007D0000-0x00000000007DC000-memory.dmp
                                                                          Filesize

                                                                          48KB

                                                                        • memory/1196-220-0x00000000007E0000-0x00000000007E7000-memory.dmp
                                                                          Filesize

                                                                          28KB

                                                                        • memory/1244-157-0x0000000000000000-mapping.dmp
                                                                        • memory/1252-219-0x00000000006A0000-0x00000000007EA000-memory.dmp
                                                                          Filesize

                                                                          1.3MB

                                                                        • memory/1252-212-0x0000000000000000-mapping.dmp
                                                                        • memory/1600-132-0x0000000000402F47-mapping.dmp
                                                                        • memory/1648-160-0x0000000000000000-mapping.dmp
                                                                        • memory/2008-174-0x0000000004F30000-0x0000000005536000-memory.dmp
                                                                          Filesize

                                                                          6.0MB

                                                                        • memory/2008-169-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                          Filesize

                                                                          128KB

                                                                        • memory/2008-173-0x0000000005050000-0x000000000508E000-memory.dmp
                                                                          Filesize

                                                                          248KB

                                                                        • memory/2008-171-0x0000000004FE0000-0x0000000004FF2000-memory.dmp
                                                                          Filesize

                                                                          72KB

                                                                        • memory/2008-170-0x0000000005540000-0x0000000005B46000-memory.dmp
                                                                          Filesize

                                                                          6.0MB

                                                                        • memory/2008-188-0x0000000006CC0000-0x0000000006E82000-memory.dmp
                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/2008-172-0x0000000005110000-0x000000000521A000-memory.dmp
                                                                          Filesize

                                                                          1.0MB

                                                                        • memory/2008-175-0x0000000005090000-0x00000000050DB000-memory.dmp
                                                                          Filesize

                                                                          300KB

                                                                        • memory/2008-186-0x00000000054C0000-0x00000000054DE000-memory.dmp
                                                                          Filesize

                                                                          120KB

                                                                        • memory/2008-185-0x00000000060F0000-0x00000000065EE000-memory.dmp
                                                                          Filesize

                                                                          5.0MB

                                                                        • memory/2008-168-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                          Filesize

                                                                          128KB

                                                                        • memory/2008-183-0x00000000053A0000-0x0000000005416000-memory.dmp
                                                                          Filesize

                                                                          472KB

                                                                        • memory/2008-166-0x0000000000419192-mapping.dmp
                                                                        • memory/2008-165-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                          Filesize

                                                                          128KB

                                                                        • memory/2008-184-0x0000000005B50000-0x0000000005BE2000-memory.dmp
                                                                          Filesize

                                                                          584KB

                                                                        • memory/2008-187-0x0000000005FD0000-0x0000000006036000-memory.dmp
                                                                          Filesize

                                                                          408KB

                                                                        • memory/2008-189-0x00000000073C0000-0x00000000078EC000-memory.dmp
                                                                          Filesize

                                                                          5.2MB

                                                                        • memory/2096-118-0x0000000000402F47-mapping.dmp
                                                                        • memory/2096-117-0x0000000000400000-0x0000000000409000-memory.dmp
                                                                          Filesize

                                                                          36KB

                                                                        • memory/2108-161-0x0000000000000000-mapping.dmp
                                                                        • memory/2136-276-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                          Filesize

                                                                          328KB

                                                                        • memory/2136-274-0x0000000000540000-0x0000000000549000-memory.dmp
                                                                          Filesize

                                                                          36KB

                                                                        • memory/2136-275-0x0000000000560000-0x00000000006AA000-memory.dmp
                                                                          Filesize

                                                                          1.3MB

                                                                        • memory/2228-163-0x0000000000000000-mapping.dmp
                                                                        • memory/2312-178-0x0000000000B09A6B-mapping.dmp
                                                                        • memory/2312-177-0x0000000000B00000-0x0000000000B15000-memory.dmp
                                                                          Filesize

                                                                          84KB

                                                                        • memory/2312-180-0x0000000000A10000-0x0000000000A11000-memory.dmp
                                                                          Filesize

                                                                          4KB

                                                                        • memory/2312-179-0x0000000000A10000-0x0000000000A11000-memory.dmp
                                                                          Filesize

                                                                          4KB

                                                                        • memory/2600-206-0x000000000483B000-0x00000000048BB000-memory.dmp
                                                                          Filesize

                                                                          512KB

                                                                        • memory/2600-215-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                          Filesize

                                                                          39.8MB

                                                                        • memory/2600-238-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                          Filesize

                                                                          39.8MB

                                                                        • memory/2600-230-0x0000000000400000-0x0000000002BC5000-memory.dmp
                                                                          Filesize

                                                                          39.8MB

                                                                        • memory/2600-201-0x0000000000000000-mapping.dmp
                                                                        • memory/2696-196-0x0000000000EC0000-0x0000000000FB1000-memory.dmp
                                                                          Filesize

                                                                          964KB

                                                                        • memory/2696-195-0x0000000000F5259C-mapping.dmp
                                                                        • memory/2696-119-0x00000000022E0000-0x00000000022E9000-memory.dmp
                                                                          Filesize

                                                                          36KB

                                                                        • memory/2696-191-0x0000000000EC0000-0x0000000000FB1000-memory.dmp
                                                                          Filesize

                                                                          964KB

                                                                        • memory/2772-130-0x00000000007F6000-0x0000000000807000-memory.dmp
                                                                          Filesize

                                                                          68KB

                                                                        • memory/2772-124-0x0000000000000000-mapping.dmp
                                                                        • memory/2964-225-0x0000000000000000-mapping.dmp
                                                                        • memory/2964-228-0x0000000002510000-0x0000000002570000-memory.dmp
                                                                          Filesize

                                                                          384KB

                                                                        • memory/2964-159-0x0000000000000000-mapping.dmp
                                                                        • memory/3040-241-0x0000000000000000-mapping.dmp
                                                                        • memory/3068-120-0x0000000001110000-0x0000000001126000-memory.dmp
                                                                          Filesize

                                                                          88KB

                                                                        • memory/3068-277-0x0000000005730000-0x0000000005746000-memory.dmp
                                                                          Filesize

                                                                          88KB

                                                                        • memory/3068-162-0x0000000002DD0000-0x0000000002DE6000-memory.dmp
                                                                          Filesize

                                                                          88KB

                                                                        • memory/3288-127-0x0000000000550000-0x000000000069A000-memory.dmp
                                                                          Filesize

                                                                          1.3MB

                                                                        • memory/3288-121-0x0000000000000000-mapping.dmp
                                                                        • memory/3288-129-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                          Filesize

                                                                          328KB

                                                                        • memory/3288-128-0x0000000000550000-0x000000000069A000-memory.dmp
                                                                          Filesize

                                                                          1.3MB

                                                                        • memory/3752-242-0x0000000000000000-mapping.dmp
                                                                        • memory/4004-240-0x000000001BA43000-0x000000001BA45000-memory.dmp
                                                                          Filesize

                                                                          8KB

                                                                        • memory/4004-236-0x0000000002C10000-0x0000000002C32000-memory.dmp
                                                                          Filesize

                                                                          136KB

                                                                        • memory/4004-231-0x0000000000000000-mapping.dmp
                                                                        • memory/4004-235-0x0000000000C50000-0x0000000000C62000-memory.dmp
                                                                          Filesize

                                                                          72KB

                                                                        • memory/4004-237-0x000000001B950000-0x000000001B9C6000-memory.dmp
                                                                          Filesize

                                                                          472KB

                                                                        • memory/4004-239-0x000000001BA40000-0x000000001BA42000-memory.dmp
                                                                          Filesize

                                                                          8KB

                                                                        • memory/4004-234-0x0000000000C50000-0x0000000000C62000-memory.dmp
                                                                          Filesize

                                                                          72KB

                                                                        • memory/4072-182-0x0000000000400000-0x00000000005CF000-memory.dmp
                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/4072-176-0x0000000000831000-0x0000000000841000-memory.dmp
                                                                          Filesize

                                                                          64KB

                                                                        • memory/4072-181-0x00000000005D0000-0x000000000071A000-memory.dmp
                                                                          Filesize

                                                                          1.3MB

                                                                        • memory/4100-273-0x00000000005D0000-0x000000000067E000-memory.dmp
                                                                          Filesize

                                                                          696KB

                                                                        • memory/4152-271-0x0000000000402F47-mapping.dmp