Analysis
- user interaction
yes - max time kernel
306s - max time network
349s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
22/08/2026, 02:00
General
- Target VisualStudioSetup.exe
- Size 5.4MB
- Sample260822-ce9baazfqa
- SHA256 4176402bd2aa92c5e68395be75c13d2872b058118554e0b6bf4d76c7de4d2499
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file 2 IoCs
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 10 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 24 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 27 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 43 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 29 IoCs
- Suspicious use of WriteProcessMemory 52 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe"C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\401154eb646a8100a3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\401154eb646a8100a3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\Admin\AppData\Local\Temp\VisualStudioSetup.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\Admin\AppData\Local\Temp"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\getmac.exe"getmac"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" /finalizeInstall install --in "C:\ProgramData\Microsoft\VisualStudio\Packages\_bootstrapper\vs_setup_bootstrapper_202608220300534856.json" --locale en-US --activityId "93690d06-ccf9-4a1f-bbff-04ea55e07683" --campaign "2500:ce7311496e924099aed87e6cfce5fab6" --pipe "b221aaa2-deec-4c5d-be70-1b043e93c4cd"3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vs_installer.windows.exe" /finalizeinstall 6F320B93-EE3C-4826-85E0-ADF79F8D4C61 "Visual Studio Installer" "Microsoft Visual Studio Installer" 4.9.50.62957 0 "C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" elevate --activityId 93690d06-ccf9-4a1f-bbff-04ea55e07683 --campaign 2500:ce7311496e924099aed87e6cfce5fab6 --handle 786814 --locale en-US --pid 1780 --pipeName 227b7593be8645efad86fe5245359ff9 --serializedSession "{\"TelemetryLevel\":null,\"IsOptedIn\":true,\"HostName\":\"Default\",\"AppInsightsInstrumentationKey\":\"f144292e-e3b2-4011-ac90-20e5c03fbce5\",\"AsimovInstrumentationKey\":\"AIF-312cbd79-9dbb-4c48-a7da-3cc2a931cb70\",\"CollectorApiKey\":\"f3e86b4023cc43f0be495508d51f588a-f70d0e59-0fb0-4473-9f19-b4024cc340be-7296\",\"AppId\":1000,\"UserId\":\"9f697196-ba41-4c19-ae9d-e39de0561a16\",\"Id\":\"0a34996f-c7e5-4f86-ad8e-e8af59d20f3d\",\"ProcessStartTime\":639229608803586194,\"SkuName\":null,\"VSExeVersion\":null,\"BucketFiltersToEnableWatsonForFaults\":[{\"AdditionalProperties\":[],\"Id\":\"a02930d9-c607-41c3-8698-0fd9196735a5\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.setup.*\",null,null,null,null,null,null,null]},{\"AdditionalProperties\":[],\"Id\":\"64a13603-6d89-42e4-a299-13f77e5ad306\",\"WatsonEventType\":\"VisualStudioNonFatalErrors2\",\"BucketParameterFilters\":[null,null,\"(?i)vs\\.willow.*\",null,null,null,null,null,null,null]}],\"BucketFiltersToAddDumpsToFaults\":[]}"4⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoLogo -NoProfile -Noninteractive -File "C:\Program Files (x86)\Microsoft Visual Studio\Installer\PrecheckTools\Microsoft.VisualStudio.Setup.TestPowerShell.ps1"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" queue pause5⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" queue pause5⤵
-
-
-
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\VSInstallerElevationService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa3930c728,0x7ffa3930c734,0x7ffa3930c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1756,i,5098545986441420474,9034699860704387061,262144 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2024 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,16566805016808574419,17526378122079871740,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2304 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2428,i,13472092223538786624,13397772814525207014,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,6857045735738993524,12350755970692841692,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3296,i,362427185052529879,1405855637308976151,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4516,i,1981777317087386816,6033320544834213546,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4524 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,14817012015471554030,11241245796479025260,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,10730069742887937333,11323843154568996573,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5784,i,4182214690913176043,5439617112368333506,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5804 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4464,i,7360059425437985780,8662866090648213756,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5932 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,16560305124313490827,5083340800655868611,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6292,i,7350108878668788168,17601745029659744781,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3988 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6256,i,4358527053109234718,18402677683226646876,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,13611353924910296125,2207892083425722763,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6860 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6844,i,15615060435385522214,3736594151702940406,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6168 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3280,i,10644381710871123557,2505955258235063946,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6684 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4444,i,3788495561528551756,1055099528753731665,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4776 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3972,i,3329081409437417608,9618048575645968219,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6752 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6540,i,7333394218667278154,12840678291806620485,262144 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6756 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6216,i,8598959449226983644,15248352040498909741,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4736,i,12133806542323552848,2471358122844718993,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6928,i,7271243758336951150,2979245776744337193,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6912 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6804,i,4374994834966423370,5326800293470162960,2097152 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,6841384622751346584,1489157211941760279,524288 --field-trial-handle=2032,i,17842465974070348377,10290618700184104272,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=868 /prefetch:82⤵
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9D357F8F55C40644C7213AA82B1C3A32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f8 0x2c01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\QuorumAPI.rar"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7278A4DE704959B311C1A444614931A7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7278A4DE704959B311C1A444614931A7 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2090969568D4AB7A9EA11F6F2974124D --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\resources\app\ServiceHub\Services\Microsoft.VisualStudio.Setup.Service\BackgroundDownload.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Desktop\PublishTest.xltx"1⤵
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" resume --installPath "C:\Program Files\Microsoft Visual Studio\18\Community" --runOnce --installSessionId 9f1266f2-305a-4d82-a470-7f7b06bc85eb1⤵
-
C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe"C:\Program Files (x86)\Microsoft Visual Studio\Installer\setup.exe" resume --installPath "C:\Program Files\Microsoft Visual Studio\18\Community" --installSessionId 9f1266f2-305a-4d82-a470-7f7b06bc85eb2⤵
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
e59b649.rbs
msalruntime_x86.dll
CommandLine.dll
Markdig.Wpf.dll
Microsoft.VisualStudio.Imaging.Interop.14.0.DesignTime.dll
Microsoft.VisualStudio.Imaging.dll
Microsoft.VisualStudio.Setup.InstallerResources.dll
Microsoft.VisualStudio.Threading.dll
Microsoft.VisualStudio.Utilities.dll
Microsoft.VisualStudio.Validation.dll
Newtonsoft.Json.dll
setup.exe
setup.exe.config
vs_installer.version.json
state.json
vs_setup_bootstrapper_202608220300534856.json
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
temp-index
the-real-index
the-real-index
the-real-index
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5b0319.TMP
the-real-index
the-real-index~RFe5b2b81.TMP
index.txt
index.txt
index.txt
index.txt~RFe59dedd.TMP
the-real-index
the-real-index
the-real-index
temp-index
index.txt
index.txt~RFe5a20d7.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
20260822020159_7a5e10a04d8a4e27a6afb94282403e2c.trn
20260822020229_fdd28de728664a1193beb22c44d3da30.trn
20260822020506_1875ee93f6b142b8a149acaa5d28885a.trn
.updateUri
channels.json
channelManifest.json
state.json
channelManifest.json
RemoteSettings_Installer[1].cache
DisabledFlights[1].cache
ShippedFlights[1].cache
dyntelconfig[1].cache
2014liig.qzf
Microsoft.C2RSignatureReader.Interop.dll
Microsoft.C2RSignatureReader.Native.dll
Microsoft.IdentityModel.Abstractions.dll
Microsoft.VisualStudio.RemoteControl.dll
Microsoft.VisualStudio.Services.Common.dll
Microsoft.VisualStudio.Setup.Common.dll
Microsoft.VisualStudio.Setup.Download.dll
Microsoft.VisualStudio.Setup.dll
Microsoft.VisualStudio.Telemetry.dll
Microsoft.VisualStudio.Utilities.Internal.dll
Newtonsoft.Json.dll
System.Buffers.dll
System.Diagnostics.DiagnosticSource.dll
System.IO.FileSystem.AccessControl.dll
System.Memory.dll
System.Net.Http.Formatting.dll
System.Numerics.Vectors.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Security.Cryptography.ProtectedData.dll
System.Security.Principal.Windows.dll
System.Threading.Tasks.Extensions.dll
VSInstallerElevationService.Contracts.dll
detection.json
msalruntime_arm64.dll
msalruntime.dll
vs_setup_bootstrapper.config
vs_setup_bootstrapper.exe
vs_setup_bootstrapper.exe.config
__PSScriptPolicyTest_f2vxogyx.qy0.ps1
kwdpqmup.json
m3edzats.json
Microsoft.Build.vsix
payload.vsix
cab1.cab
Microsoft.Build.UnGAC.exe
Microsoft.DataAI.NuGetRecommender.vsix
Microsoft.Developer.IdentityServiceGS.vsix
payload.vsix
payload.vsix
Microsoft.DiagnosticsHub.Collection.x64.vsix
cabx64_1.cab
Microsoft.DiagnosticsHub.Runtime.vsix
Microsoft.DiagnosticsHub.Runtime.Targeted.x64.vsix
payload.vsix
payload.vsix
aspnetcore-runtime-x64.zip
windowsdesktop-runtime-x64.zip
sdk_tools48.cab
aspnetcore-runtime-x64.zip
windowsdesktop-runtime-x64.zip
Microsoft.ServiceHub.Node.vsix
Microsoft.VisualCpp.Tools.Common.Utils.vsix
Microsoft.VisualCpp.Tools.Common.Utils.Resources.enu.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
cab1.cab
cab1.cab
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
cab1.cab
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Connected.Auto.vsix
payload.vsix
Microsoft.VisualStudio.ConnectedServices.Core.vsix
Microsoft.VisualStudio.Copilot.Contracts.vsix
Microsoft.VisualStudio.CoreDotNet.vsix
UserProfiles.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Debugger.BrokeredServices.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.Debugger.VSCodeDebuggerHost.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.ErrorList.vsix
Microsoft.VisualStudio.ExtensionManager.vsix
Microsoft.VisualStudio.ExtensionManager.vsix
cab1.cab
cab1.cab
payload.vsix
payload.vsix
Microsoft.VisualStudio.GraphProvider.Auto.vsix
payload.vsix
VSInitializer.exe
Microsoft.VisualStudio.LanguageServer.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.MefHosting.vsix
Microsoft.VisualStudio.MinShell.Auto.vsix
Microsoft.VisualStudio.MinShell.Auto.vsix
payload.vsix
payload.vsix
cab1.cab
cab1.cab
cab1.cab
payload.vsix
cab1.cab
Microsoft.VisualStudio.MinShell.x64.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.NgenRunner.vsix
NuGet.Tools.vsix
Microsoft.VisualStudio.NuGet.Mcp.Server.vsix
Microsoft.VisualStudio.NuGet.Mcp.Server.vsix
Microsoft.VisualStudio.OpenFolder.vsix
Microsoft.VisualStudio.OpenTelemetry.Core.netfx.vsix
payload.vsix
Microsoft.VisualStudio.Platform.CallHierarchy.vsix
Microsoft.VisualStudio.Platform.Editor.vsix
Microsoft.VisualStudio.Platform.Markdown.vsix
Microsoft.VisualStudio.Platform.NavigateTo.vsix
Microsoft.VisualStudio.Platform.Terminal.vsix
Microsoft.VisualStudio.Platform.Terminal.vsix
payload.vsix
Microsoft.VisualStudio.ProjectServices.vsix
Microsoft.VisualStudio.ProjectSystem.Vsix
Microsoft.VisualStudio.ProjectSystem.Full.vsix
Microsoft.VisualStudio.ProjectSystem.Query.Vsix
Microsoft.VisualStudio.ScriptedHost.vsix
Microsoft.VisualStudio.ScriptedHost.vsix
payload.vsix
Microsoft.VisualStudio.TeamExplorer.vsix
payload.vsix
Microsoft.VisualStudio.TextMateGrammars.vsix
Microsoft.VisualStudio.UIInternal.vsix
Microsoft.VisualStudio.UIInternal.Guide.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.VsWebProtocolSelector.Msi.msi
cab1.cab
Microsoft.VisualStudio.WPF.Internal.x64.vsix
payload.vsix
payload.vsix
payload.vsix
Microsoft.VisualStudio.WebToolsExtensions.Json.vsix
Microsoft.VisualStudio.WhatsNew.vsix
Microsoft.WebTools.DotNet.Core.ItemTemplates.vsix
Microsoft.WebTools.Languages.Shared.vsix
SqlCommon.vsix
SQLCommon.amd64.vsix
config_devenv.vsix
config_devhub_DotNetCurrent.vsix
config_devhub_DotNetPrevious.vsix
microsoft.bcl.asyncinterfaces_10.0.8_netfx.vsix
microsoft.bcl.timeprovider_8.0.1_netfx.vsix
microsoft.extensions.dependencyinjection.abstractions_10.0.8_netfx.vsix
microsoft.extensions.logging.abstractions_10.0.8_netfx.vsix
microsoft.identitymodel.abstractions_8.15.0_netfx.vsix
microsoft.identitymodel.jsonwebtokens_8.15.0_netfx.vsix
microsoft.identitymodel.logging_8.15.0_netfx.vsix
microsoft.identitymodel.tokens_8.15.0_netfx.vsix
microsoft.visualstudio.remotecontrol_16.3.52_netfx.vsix
microsoft.visualstudio.utilities.internal_16.3.90_netfx.vsix
microsoft.visualstudio.validation_18.7.1_net10.0.vsix
microsoft.visualstudio.validation_18.7.1_net8.0.vsix
microsoft.visualstudio.validation_18.7.1_netfx.vsix
newtonsoft.json_13.0.4_netfx.vsix
SQLSysClrTypes.msi
system.buffers_4.6.1_netfx.vsix
system.collections.immutable_10.0.8_netfx.vsix
system.diagnostics.diagnosticsource_10.0.8_netfx.vsix
system.identitymodel.tokens.jwt_8.15.0_netfx.vsix
system.io.pipelines_10.0.8_netfx.vsix
system.memory_4.6.3_netfx.vsix
system.numerics.vectors_4.6.1_netfx.vsix
system.reflection.metadata_10.0.8_netfx.vsix
system.reflection.metadataloadcontext_10.0.8_netfx.vsix
system.runtime.compilerservices.unsafe_6.1.2_netfx.vsix
system.text.encodings.web_10.0.8_netfx.vsix
system.text.json_10.0.8_netfx.vsix
system.threading.channels_10.0.8_netfx.vsix
system.threading.tasks.dataflow_10.0.8_netfx.vsix
system.threading.tasks.extensions_4.6.3_netfx.vsix
ylthmc1l.json
default.dic
user.json
QuorumAPI.rar
memory/1780-1214-0x00000228F3170000-0x00000228F317A000-memory.dmp
memory/1780-1161-0x00000228EE780000-0x00000228EE820000-memory.dmp
memory/1780-1441-0x00000228F6E80000-0x00000228F6E8A000-memory.dmp
memory/1780-1440-0x00000228F6E60000-0x00000228F6E68000-memory.dmp
memory/1780-1442-0x00000228F6ED0000-0x00000228F6F0E000-memory.dmp
memory/1780-1157-0x00000228D4010000-0x00000228D431A000-memory.dmp
memory/1780-1443-0x00000228F6EB0000-0x00000228F6EC8000-memory.dmp
memory/1780-1438-0x00000228F7FB0000-0x00000228F7FD8000-memory.dmp
memory/1780-1434-0x00000228F7F50000-0x00000228F7F5A000-memory.dmp
memory/1780-1290-0x00000228EE3B0000-0x00000228EE3C2000-memory.dmp
memory/1780-1287-0x00000228EE370000-0x00000228EE388000-memory.dmp
memory/1780-1288-0x00000228EE360000-0x00000228EE36E000-memory.dmp
memory/1780-1286-0x00000228EE430000-0x00000228EE438000-memory.dmp
memory/1780-1273-0x00000228EE230000-0x00000228EE238000-memory.dmp
memory/1780-1272-0x00000228EE220000-0x00000228EE228000-memory.dmp
memory/1780-1264-0x00000228F3660000-0x00000228F3796000-memory.dmp
memory/1780-1159-0x00000228EE910000-0x00000228EEA96000-memory.dmp
memory/1780-1444-0x00000228F8190000-0x00000228F819A000-memory.dmp
memory/1780-1224-0x00000228F33C0000-0x00000228F33D2000-memory.dmp
memory/1780-1210-0x00000228F3190000-0x00000228F31A2000-memory.dmp
memory/1780-1211-0x00000228F3290000-0x00000228F32EE000-memory.dmp
memory/1780-1212-0x00000228F3260000-0x00000228F3282000-memory.dmp
memory/1780-1213-0x00000228F3410000-0x00000228F3460000-memory.dmp
memory/1780-1445-0x00000228F80A0000-0x00000228F8154000-memory.dmp
memory/1780-1215-0x00000228F3230000-0x00000228F324E000-memory.dmp
memory/1780-1216-0x00000228F32F0000-0x00000228F330C000-memory.dmp
memory/1780-1217-0x00000228F3560000-0x00000228F365C000-memory.dmp
memory/1780-1163-0x00000228EE820000-0x00000228EE8BE000-memory.dmp
memory/1780-1209-0x00000228F3330000-0x00000228F33B8000-memory.dmp
memory/1780-1206-0x00000228F31D0000-0x00000228F3224000-memory.dmp
memory/1780-1204-0x00000228F04D0000-0x00000228F04D8000-memory.dmp
memory/1780-1203-0x00000228F04F0000-0x00000228F0532000-memory.dmp
memory/1780-1202-0x00000228EFFC0000-0x00000228EFFCE000-memory.dmp
memory/1780-1201-0x00000228F0360000-0x00000228F0398000-memory.dmp
memory/1780-1199-0x00000228EF6D0000-0x00000228EF6DC000-memory.dmp
memory/1780-1197-0x00000228F0160000-0x00000228F021A000-memory.dmp
memory/1780-1196-0x00000228EFFF0000-0x00000228F015E000-memory.dmp
memory/1780-1194-0x00000228EFDF0000-0x00000228EFE7A000-memory.dmp
memory/1780-1192-0x00000228EF660000-0x00000228EF66E000-memory.dmp
memory/1780-1188-0x00000228EEC40000-0x00000228EEC48000-memory.dmp
memory/1780-1190-0x00000228EEC50000-0x00000228EEC60000-memory.dmp
memory/1780-1182-0x00000228EF5D0000-0x00000228EF5F8000-memory.dmp
memory/1780-1186-0x00000228D4710000-0x00000228D471C000-memory.dmp
memory/1780-1184-0x00000228EEC30000-0x00000228EEC38000-memory.dmp
memory/1780-1180-0x00000228EE8F0000-0x00000228EE904000-memory.dmp
memory/1780-1177-0x00000228D6060000-0x00000228D607A000-memory.dmp
memory/1780-1178-0x00000228EF6E0000-0x00000228EF7EA000-memory.dmp
memory/1780-1175-0x00000228D4720000-0x00000228D472E000-memory.dmp
memory/1780-1171-0x00000228EEBE0000-0x00000228EEC10000-memory.dmp
memory/1780-1169-0x00000228EE8C0000-0x00000228EE8E2000-memory.dmp
memory/1780-1168-0x00000228EEBA0000-0x00000228EEBDC000-memory.dmp
memory/1780-1166-0x00000228EEC60000-0x00000228EED14000-memory.dmp
memory/3048-1259-0x000001F4C3CC0000-0x000001F4C3CD0000-memory.dmp
memory/4352-1252-0x0000023599300000-0x000002359930E000-memory.dmp
memory/4672-1446-0x000001F6B4A50000-0x000001F6B4A58000-memory.dmp
memory/4672-1439-0x000001F6B3740000-0x000001F6B377C000-memory.dmp
memory/4672-1447-0x000001F6B33E0000-0x000001F6B33E8000-memory.dmp
memory/4708-236-0x0000000007C10000-0x00000000081B4000-memory.dmp
memory/4708-233-0x0000000006670000-0x00000000069C4000-memory.dmp
memory/4708-183-0x0000000000A60000-0x0000000000AB4000-memory.dmp
memory/4708-261-0x000000000BE90000-0x000000000BEA2000-memory.dmp
memory/4708-260-0x000000000C2C0000-0x000000000C310000-memory.dmp
memory/4708-187-0x0000000005660000-0x00000000057E6000-memory.dmp
memory/4708-257-0x000000000AE30000-0x000000000AF30000-memory.dmp
memory/4708-256-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-255-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-254-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-253-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-252-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-251-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-250-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-249-0x000000000AB70000-0x000000000AB7E000-memory.dmp
memory/4708-248-0x000000000ABB0000-0x000000000ABE8000-memory.dmp
memory/4708-247-0x000000000AE30000-0x000000000AF30000-memory.dmp
memory/4708-246-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-245-0x000000000A590000-0x000000000A598000-memory.dmp
memory/4708-242-0x000000000A570000-0x000000000A578000-memory.dmp
memory/4708-203-0x00000000059F0000-0x0000000005A44000-memory.dmp
memory/4708-243-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-204-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-244-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-279-0x000000000BD10000-0x000000000BD32000-memory.dmp
memory/4708-191-0x0000000005A90000-0x0000000005B30000-memory.dmp
memory/4708-195-0x0000000005C40000-0x0000000005D4A000-memory.dmp
memory/4708-199-0x0000000005490000-0x000000000549A000-memory.dmp
memory/4708-208-0x0000000005FE0000-0x0000000006094000-memory.dmp
memory/4708-212-0x0000000005F40000-0x0000000005F54000-memory.dmp
memory/4708-216-0x0000000005F90000-0x0000000005FB8000-memory.dmp
memory/4708-220-0x0000000005F70000-0x0000000005F78000-memory.dmp
memory/4708-224-0x0000000006330000-0x0000000006340000-memory.dmp
memory/4708-237-0x0000000007AE0000-0x0000000007B9A000-memory.dmp
memory/4708-278-0x000000000BCD0000-0x000000000BCDC000-memory.dmp
memory/4708-235-0x00000000075C0000-0x0000000007652000-memory.dmp
memory/4708-234-0x0000000006F80000-0x0000000006FE6000-memory.dmp
memory/4708-239-0x0000000005F10000-0x0000000005F20000-memory.dmp
memory/4708-232-0x0000000006640000-0x0000000006662000-memory.dmp
memory/5808-3595-0x00007FFA15610000-0x00007FFA15620000-memory.dmp
memory/5808-3596-0x00007FFA15610000-0x00007FFA15620000-memory.dmp
memory/5808-3594-0x00007FFA15610000-0x00007FFA15620000-memory.dmp
memory/5808-3901-0x00007FFA15610000-0x00007FFA15620000-memory.dmp
memory/5808-3902-0x00007FFA15610000-0x00007FFA15620000-memory.dmp
memory/5808-3903-0x00007FFA15610000-0x00007FFA15620000-memory.dmp
memory/5808-3597-0x00007FFA15610000-0x00007FFA15620000-memory.dmp
memory/5808-3600-0x00007FFA12CB0000-0x00007FFA12CC0000-memory.dmp
memory/5808-3599-0x00007FFA12CB0000-0x00007FFA12CC0000-memory.dmp
memory/5808-3904-0x00007FFA15610000-0x00007FFA15620000-memory.dmp
memory/5808-3598-0x00007FFA15610000-0x00007FFA15620000-memory.dmp