Overview

overview

10

Static

static

3

Fatality.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    156s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/03/2025, 01:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fatality.exe

  • Size

    4.3MB

  • MD5

    87ec8a86c4477f7f07870c2e986a41ac

  • SHA1

    7c29508c83f5f4e2eba74781f90158ac2e6f9c45

  • SHA256

    c6cd7c317902053a4334a142ba9f061161a891ffb01220f486c42019d6ecb117

  • SHA512

    e3c55d3bf6333863d769a1e9277f54b6cf5a1384aea6c4da179092a960aedf5591c7bab480bb909f786758e26784a5acea3cf446ac3a37624b35877ffdacbef7

  • SSDEEP

    98304:nWIpskZHDRgx3iS1U4NewTXlQuT/3Bzi0tbihNuJpQF7:nv5kySZNhzT/JlbINu+7

Score
10/10
salatstealercredential_accessdiscoveryspywarestealerupx

Malware Config

Signatures

  • Detect SalatStealer payload 55 IoCs
  • Salatstealer family
    salatstealer
  • salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fatality.exe
    "C:\Users\Admin\AppData\Local\Temp\Fatality.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5848
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4468
    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:4816
      • C:\Users\Admin\AppData\Local\Temp\fatality.exe
        "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:4836
        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4708
        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4580
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1972
            • C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\taskhostw.exe
              C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\taskhostw.exe
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:624
              • C:\Program Files\Google\Chrome\Application\taskhostw.exe
                "C:\Program Files\Google\Chrome\Application\taskhostw.exe" -
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5540
              • C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\taskhostw.exe" -
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1588
          • C:\Users\Admin\AppData\Local\Temp\fatality.exe
            "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
            5⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:4976
            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1220
            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
              6⤵
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:3780
              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4908
              • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                7⤵
                • Checks computer location settings
                • Suspicious use of WriteProcessMemory
                PID:4936
                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2632
                • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                  "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                  8⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:5780
                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2140
                  • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                    "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                    9⤵
                    • Checks computer location settings
                    • Suspicious use of WriteProcessMemory
                    PID:4812
                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                      10⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3548
                    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                      10⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:3408
                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                        11⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5032
                      • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                        "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                        11⤵
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:1524
                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                          12⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:5176
                        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                          12⤵
                          • Checks computer location settings
                          PID:3440
                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:744
                          • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                            "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                            13⤵
                            • Checks computer location settings
                            PID:116
                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:5920
                            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                              14⤵
                                PID:4060
                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                  15⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5984
                                • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                  "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                  15⤵
                                  • Checks computer location settings
                                  PID:1824
                                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    PID:1380
                                  • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                    "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                    16⤵
                                    • Checks computer location settings
                                    PID:4716
                                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                      17⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:4908
                                    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                      17⤵
                                      • Checks computer location settings
                                      PID:1472
                                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                        18⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:6048
                                      • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                        "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                        18⤵
                                        • Checks computer location settings
                                        PID:5268
                                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                          19⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:5164
                                        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                          19⤵
                                          • Checks computer location settings
                                          PID:612
                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                            20⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:5896
                                          • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                            "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                            20⤵
                                            • Checks computer location settings
                                            PID:5208
                                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:4708
                                            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                              21⤵
                                              • Checks computer location settings
                                              PID:4912
                                              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                22⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:2888
                                              • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                22⤵
                                                • Checks computer location settings
                                                PID:348
                                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                  23⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3980
                                                • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                  23⤵
                                                  • Checks computer location settings
                                                  PID:5732
                                                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                    24⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4928
                                                  • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                    24⤵
                                                    • Checks computer location settings
                                                    PID:5636
                                                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                      25⤵
                                                      • Executes dropped EXE
                                                      PID:3776
                                                    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                      25⤵
                                                      • Checks computer location settings
                                                      PID:3828
                                                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                        26⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5404
                                                      • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                        26⤵
                                                        • Checks computer location settings
                                                        PID:5780
                                                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                          27⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5284
                                                        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                          27⤵
                                                            PID:5200
                                                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                              28⤵
                                                              • Executes dropped EXE
                                                              • System Location Discovery: System Language Discovery
                                                              PID:6000
                                                            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                              28⤵
                                                              • Checks computer location settings
                                                              PID:5164
                                                              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                29⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2832
                                                              • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                29⤵
                                                                • Checks computer location settings
                                                                PID:4528
                                                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                  30⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2092
                                                                • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                  30⤵
                                                                  • Checks computer location settings
                                                                  PID:5492
                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                    31⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:4396
                                                                  • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                    31⤵
                                                                    • Checks computer location settings
                                                                    PID:4932
                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                      32⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:4476
                                                                    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                      32⤵
                                                                      • Checks computer location settings
                                                                      PID:5848
                                                                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                        33⤵
                                                                        • Executes dropped EXE
                                                                        PID:1980
                                                                      • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                        33⤵
                                                                        • Checks computer location settings
                                                                        PID:3076
                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                          34⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:4912
                                                                        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                          34⤵
                                                                          • Checks computer location settings
                                                                          PID:3352
                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                            35⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4060
                                                                          • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                            35⤵
                                                                            • Checks computer location settings
                                                                            PID:3872
                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                              36⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4104
                                                                            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                              36⤵
                                                                              • Checks computer location settings
                                                                              PID:1100
                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                37⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:2308
                                                                              • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                37⤵
                                                                                • Checks computer location settings
                                                                                PID:5968
                                                                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                  38⤵
                                                                                  • Executes dropped EXE
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:5932
                                                                                • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                  38⤵
                                                                                  • Checks computer location settings
                                                                                  PID:5600
                                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                    39⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:4644
                                                                                  • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                    39⤵
                                                                                    • Checks computer location settings
                                                                                    PID:3232
                                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                      40⤵
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:4620
                                                                                    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                      40⤵
                                                                                      • Checks computer location settings
                                                                                      PID:6140
                                                                                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                        41⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:2864
                                                                                      • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                        41⤵
                                                                                        • Checks computer location settings
                                                                                        PID:4140
                                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                          42⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4756
                                                                                        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                          42⤵
                                                                                          • Checks computer location settings
                                                                                          PID:4556
                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                            43⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4424
                                                                                          • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                            43⤵
                                                                                            • Checks computer location settings
                                                                                            PID:1536
                                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                              44⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2284
                                                                                            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                              44⤵
                                                                                              • Checks computer location settings
                                                                                              PID:2092
                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                45⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4836
                                                                                              • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                45⤵
                                                                                                • Checks computer location settings
                                                                                                PID:5492
                                                                                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                  46⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3336
                                                                                                • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                  46⤵
                                                                                                  • Checks computer location settings
                                                                                                  PID:5480
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                    47⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:4708
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                    47⤵
                                                                                                    • Checks computer location settings
                                                                                                    PID:5196
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                      48⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:5724
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                      48⤵
                                                                                                      • Checks computer location settings
                                                                                                      PID:456
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                        49⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:1412
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                        49⤵
                                                                                                        • Checks computer location settings
                                                                                                        PID:2060
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                          50⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:3792
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                          50⤵
                                                                                                          • Checks computer location settings
                                                                                                          PID:2376
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                            51⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2352
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                            51⤵
                                                                                                            • Checks computer location settings
                                                                                                            PID:1252
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                              52⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4044
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                              52⤵
                                                                                                              • Checks computer location settings
                                                                                                              PID:1556
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                53⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:4644
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                53⤵
                                                                                                                • Checks computer location settings
                                                                                                                PID:5600
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                  54⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4500
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                  54⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  PID:2660
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                    55⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:976
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                    55⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    PID:3440
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                      56⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5640
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                      56⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      PID:4480
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                        57⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4140
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                        57⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        PID:5596
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                          58⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1640
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                          58⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          PID:4556
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                            59⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:1600
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                            59⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            PID:1628
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                              60⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4564
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                              60⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              PID:1852
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                61⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5276
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                                61⤵
                                                                                                                                • Checks computer location settings
                                                                                                                                PID:4360
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                  62⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3940
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                                  62⤵
                                                                                                                                  • Checks computer location settings
                                                                                                                                  PID:3988
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                    63⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:2888
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Checks computer location settings
                                                                                                                                    PID:4292
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                      64⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2040
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                                      64⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      PID:1580
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                        65⤵
                                                                                                                                          PID:4060
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                                          65⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          PID:4256
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                            66⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5636
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                                            66⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            PID:4452
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
                                                                                                                                              67⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:3616
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\fatality.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\fatality.exe"
                                                                                                                                              67⤵
                                                                                                                                                PID:3412
          • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
            1⤵
              PID:3608
            • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
              "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
              1⤵
                PID:4288
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /7
                1⤵
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1824
              • C:\Windows\System32\rundll32.exe
                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                1⤵
                  PID:4040
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SDRSVC
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4572

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fatality.exe.log
                  Filesize

                  654B

                  MD5

                  2ff39f6c7249774be85fd60a8f9a245e

                  SHA1

                  684ff36b31aedc1e587c8496c02722c6698c1c4e

                  SHA256

                  e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                  SHA512

                  1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                  Filesize

                  3.1MB

                  MD5

                  244a6c09bc6ba607ee59b5efa46a8703

                  SHA1

                  924d4d52dad661bf30a52ccc6617e9d55ea8ea3b

                  SHA256

                  0fe932f5c1c2e5023089795a9caef8427f716bce92f2903d668cc8f98d352b6f

                  SHA512

                  b1ef92ce0d79da152631376fb7c2c879be22f869458c29d1efe035cec2c4e4ec12b61959118ce95512ed79f852ecd6600de0d790cb456db7c19e00a096b19b4a

                  Download Submit

                • memory/624-277-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-320-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-415-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-350-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-51-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-227-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-189-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-381-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-152-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-114-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/624-105-0x0000000000E70000-0x00000000019ED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/744-142-0x0000000000520000-0x000000000109D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/1220-61-0x0000000000F90000-0x0000000001B0D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/1220-63-0x0000000000F90000-0x0000000001B0D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/1380-170-0x0000000000170000-0x0000000000CED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/1588-94-0x0000000000400000-0x0000000000F7D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/1824-263-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-267-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-266-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-264-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-265-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-256-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-257-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-255-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-261-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1824-262-0x000001DB139D0000-0x000001DB139D1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1972-42-0x0000000000C20000-0x000000000179D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/1972-53-0x0000000000C20000-0x000000000179D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/1980-335-0x0000000000750000-0x00000000012CD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/2092-313-0x00000000006F0000-0x000000000126D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/2140-104-0x0000000000C40000-0x00000000017BD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/2284-414-0x0000000000190000-0x0000000000D0D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/2308-364-0x0000000000810000-0x000000000138D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/2632-95-0x0000000000A30000-0x00000000015AD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/2832-304-0x00000000004E0000-0x000000000105D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/2864-393-0x00000000002B0000-0x0000000000E2D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/2888-226-0x0000000000AE0000-0x000000000165D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/3548-115-0x0000000000CE0000-0x000000000185D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/3776-254-0x0000000000E60000-0x00000000019DD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/3980-236-0x0000000000FE0000-0x0000000001B5D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4060-349-0x0000000000C40000-0x00000000017BD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4104-357-0x0000000000500000-0x000000000107D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4396-321-0x0000000000070000-0x0000000000BED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4424-407-0x0000000000390000-0x0000000000F0D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4468-13-0x0000000000550000-0x00000000010CD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4468-18-0x0000000000550000-0x00000000010CD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4476-328-0x0000000000300000-0x0000000000E7D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4572-21-0x00007FF982130000-0x00007FF982BF1000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4572-14-0x00007FF982130000-0x00007FF982BF1000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4572-17-0x00007FF982130000-0x00007FF982BF1000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/4620-386-0x00000000006C0000-0x000000000123D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4644-378-0x00000000009D0000-0x000000000154D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4708-31-0x0000000000FE0000-0x0000000001B5D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4708-217-0x0000000000EB0000-0x0000000001A2D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4708-33-0x0000000000FE0000-0x0000000001B5D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4756-400-0x0000000000610000-0x000000000118D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4816-23-0x0000000000550000-0x00000000010CD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4816-20-0x0000000000550000-0x00000000010CD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4908-79-0x0000000000F40000-0x0000000001ABD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4908-81-0x0000000000F40000-0x0000000001ABD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4908-179-0x0000000000990000-0x000000000150D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4912-342-0x0000000000F70000-0x0000000001AED000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/4928-245-0x00000000004D0000-0x000000000104D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5032-124-0x0000000000510000-0x000000000108D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5164-199-0x00000000007F0000-0x000000000136D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5176-133-0x00000000000D0000-0x0000000000C4D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5284-286-0x0000000000650000-0x00000000011CD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5404-276-0x0000000000F20000-0x0000000001A9D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5540-72-0x00000000005A0000-0x000000000111D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5540-68-0x00000000005A0000-0x000000000111D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5848-0-0x00007FF982133000-0x00007FF982135000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/5848-1-0x0000000000E20000-0x0000000001274000-memory.dmp

                  Filesize

                  4.3MB

                  Download

                • memory/5848-3-0x00007FF982130000-0x00007FF982BF1000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/5848-15-0x00007FF982130000-0x00007FF982BF1000-memory.dmp

                  Filesize

                  10.8MB

                  Download

                • memory/5896-208-0x00000000002F0000-0x0000000000E6D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5920-151-0x0000000000500000-0x000000000107D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5932-371-0x0000000000430000-0x0000000000FAD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/5984-161-0x0000000000460000-0x0000000000FDD000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/6000-295-0x0000000000BA0000-0x000000000171D000-memory.dmp

                  Filesize

                  11.5MB

                  Download

                • memory/6048-188-0x0000000000CE0000-0x000000000185D000-memory.dmp

                  Filesize

                  11.5MB

                  Download