Overview

overview

10

Static

static

10

TikTok Che....2.exe

windows10-2004-x64

10

TikTok Che....2.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    901s
  • max time network
    903s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 07:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    TikTok Checker v2.2.exe
  • Size 16.4MB
  • Sample260910-je9qdazelg
  • SHA256 0446aa639f5d048a5509a9b66466326f666fdf5a8bdeb150ffd812a9c588a4f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adware24x01x2026crypteddefaultloadeddiscoverydownloaderexecutionasyncratredlinestealcsvcstealerinfostealerinstallerpersistenceransomwareratspywarestealerupx

Malware Config

Extracted

Family

  • stealc

Botnet

  • crypted

C2

  • http://196.251.107.23

Attributes
  • url_path

    /04ca1421433e0038.php

rc4.traffic_key
rc4.C2

Extracted

Family

  • redline

Botnet

  • loaded

C2

  • 196.251.107.104:1912

Extracted

Family

  • stealc

Botnet

  • 24x01x2026

C2

  • http://196.251.107.23

Attributes
  • url_path

    /04ca1421433e0038.php

rc4.traffic_key
rc4.C2

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • Default

C2

  • 196.251.107.104:6606

  • 196.251.107.104:7707

  • 196.251.107.104:8808

Mutex

  • kqNlEor85bqX

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Family: RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Family: Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Family: SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Async RAT payload 1 IoCs
    rat
  • Detects Stealc stealer Version 2 6 IoCs
  • Detects Stealc stealer Version 3 6 IoCs
  • Detects SvcStealer Payload 1 IoCs

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • RedLine payload 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 57 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 44 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 16 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Protected Mode 1 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 39 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5284
    • C:\Users\Admin\AppData\Local\Temp\TikTok Checker v2.2.exe
      "C:\Users\Admin\AppData\Local\Temp\TikTok Checker v2.2.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Users\Admin\AppData\Roaming\foipbiu.exe
        "C:\Users\Admin\AppData\Roaming\foipbiu.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Windows\helpPane.exe
          "C:\Windows\helpPane.exe"
          4⤵
            PID:5904
        • C:\Users\Admin\AppData\Roaming\ksobvux.exe
          "C:\Users\Admin\AppData\Roaming\ksobvux.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2632
          • C:\Users\Admin\AppData\Local\Temp\is-HRJ6G.tmp\ksobvux.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-HRJ6G.tmp\ksobvux.tmp" /SL5="$3019A,4880337,828416,C:\Users\Admin\AppData\Roaming\ksobvux.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4896
            • C:\Users\Admin\AppData\Roaming\ksobvux.exe
              "C:\Users\Admin\AppData\Roaming\ksobvux.exe" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3640
              • C:\Users\Admin\AppData\Local\Temp\is-EUA6L.tmp\ksobvux.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-EUA6L.tmp\ksobvux.tmp" /SL5="$4019A,4880337,828416,C:\Users\Admin\AppData\Roaming\ksobvux.exe" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:2396
                • C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe
                  "C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe" -Embedding
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks SCSI registry key(s)
                  • Suspicious use of WriteProcessMemory
                  PID:2532
                  • C:\Windows\system32\cmd.exe
                    "cmd.exe" /c start "" C:\Users\Admin\taskhost.exe
                    8⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:3120
                    • C:\Users\Admin\taskhost.exe
                      C:\Users\Admin\taskhost.exe
                      9⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:3928
                      • C:\Windows\helpPane.exe
                        "C:\Windows\helpPane.exe"
                        10⤵
                          PID:1380
          • C:\Users\Admin\AppData\Roaming\iovbuxv.exe
            "C:\Users\Admin\AppData\Roaming\iovbuxv.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2476
          • C:\Users\Admin\AppData\Roaming\sxipcuzs.exe
            "C:\Users\Admin\AppData\Roaming\sxipcuzs.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4104
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /query /tn "8B431EE270F1CAF2"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2336
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "8B431EE270F1CAF2" /tr "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3532
            • C:\Windows\SysWOW64\svchost.exe
              -k netsvcs
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4164
          • C:\Users\Admin\AppData\Roaming\aopbnixcn.exe
            "C:\Users\Admin\AppData\Roaming\aopbnixcn.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2064
            • C:\Users\Admin\AppData\Local\Temp\is-H4BQC.tmp\aopbnixcn.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-H4BQC.tmp\aopbnixcn.tmp" /SL5="$D01CA,2513863,856064,C:\Users\Admin\AppData\Roaming\aopbnixcn.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3624
              • C:\Users\Admin\AppData\Roaming\aopbnixcn.exe
                "C:\Users\Admin\AppData\Roaming\aopbnixcn.exe" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3792
                • C:\Users\Admin\AppData\Local\Temp\is-M8MN7.tmp\aopbnixcn.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-M8MN7.tmp\aopbnixcn.tmp" /SL5="$90216,2513863,856064,C:\Users\Admin\AppData\Roaming\aopbnixcn.exe" /VERYSILENT /PASSWORD=PLACEHOLDER_PASSWORD
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:3148
                  • C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\eServiceHost.exe
                    "C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\eServiceHost.exe" -Embedding
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:4844
          • C:\Users\Admin\AppData\Roaming\zipbvux.exe
            "C:\Users\Admin\AppData\Roaming\zipbvux.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:300
            • C:\Users\Admin\AppData\Local\Temp\is-BK3JD.tmp\zipbvux.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-BK3JD.tmp\zipbvux.tmp" /SL5="$A0156,2714024,817152,C:\Users\Admin\AppData\Roaming\zipbvux.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2168
              • C:\Users\Admin\AppData\Roaming\zipbvux.exe
                "C:\Users\Admin\AppData\Roaming\zipbvux.exe" /VERYSILENT /PASSWORD=c9d4bb30-cb45-43e6-a5a5-0428b46e6eec
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:904
                • C:\Users\Admin\AppData\Local\Temp\is-UBB1J.tmp\zipbvux.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-UBB1J.tmp\zipbvux.tmp" /SL5="$B0156,2714024,817152,C:\Users\Admin\AppData\Roaming\zipbvux.exe" /VERYSILENT /PASSWORD=c9d4bb30-cb45-43e6-a5a5-0428b46e6eec
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:4216
                  • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                    "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                    7⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:5896
          • C:\Users\Admin\AppData\Roaming\syncappk.exe
            "C:\Users\Admin\AppData\Roaming\syncappk.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4540
            • C:\Users\Admin\AppData\Roaming\DDFD1E134A2F1128056648\DDFD1E134A2F1128056648.exe
              "C:\Users\Admin\AppData\Roaming\DDFD1E134A2F1128056648\DDFD1E134A2F1128056648.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies Internet Explorer Protected Mode
              • Modifies Internet Explorer Protected Mode Banner
              • Modifies Internet Explorer settings
              PID:3392
      • C:\Users\Admin\AppData\Roaming\DDFD1E134A2F1128056648\DDFD1E134A2F1128056648.exe
        C:\Users\Admin\AppData\Roaming\DDFD1E134A2F1128056648\DDFD1E134A2F1128056648.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        PID:4960
      • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
        C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:8
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        1⤵
          PID:2964
        • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
          "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
          1⤵
          • Executes dropped EXE
          PID:5948
        • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
          C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5304
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5304 -s 536
            2⤵
            • Program crash
            PID:5520
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5304 -ip 5304
          1⤵
            PID:4088
          • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
            "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
            1⤵
            • Executes dropped EXE
            PID:5736
          • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
            "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3172
          • C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe
            "C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe" -Embedding
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Checks SCSI registry key(s)
            PID:5072
          • C:\Windows\system32\wbem\unsecapp.exe
            C:\Windows\system32\wbem\unsecapp.exe -Embedding
            1⤵
              PID:4516
            • C:\Windows\system32\wbem\unsecapp.exe
              C:\Windows\system32\wbem\unsecapp.exe -Embedding
              1⤵
                PID:4192
              • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                1⤵
                • Executes dropped EXE
                PID:2988
              • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:3312
              • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                1⤵
                • Executes dropped EXE
                PID:4600
              • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:576
              • C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe
                "C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe" -Embedding
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Checks SCSI registry key(s)
                PID:4312
              • C:\Windows\system32\wbem\unsecapp.exe
                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                1⤵
                  PID:5396
                • C:\Windows\system32\wbem\unsecapp.exe
                  C:\Windows\system32\wbem\unsecapp.exe -Embedding
                  1⤵
                    PID:1212
                  • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                    "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:5060
                  • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                    "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3204
                  • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                    "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:4324
                  • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                    "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:200
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                    1⤵
                      PID:4256
                    • C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe
                      "C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe" -Embedding
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Drops file in System32 directory
                      • Checks SCSI registry key(s)
                      PID:4416
                    • C:\Windows\system32\wbem\unsecapp.exe
                      C:\Windows\system32\wbem\unsecapp.exe -Embedding
                      1⤵
                        PID:3996
                      • C:\Windows\system32\wbem\unsecapp.exe
                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                        1⤵
                          PID:3396
                        • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                          "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:5968
                        • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                          "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                          1⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:5276
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:3328
                          • C:\Windows\explorer.exe
                            explorer.exe /LOADSAVEDWINDOWS
                            2⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Enumerates connected drives
                            • Checks SCSI registry key(s)
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:5372
                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:4972
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:5444
                        • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                          "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:4296
                        • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                          "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                          1⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1184
                        • C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe
                          "C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe" -Embedding
                          1⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • Checks SCSI registry key(s)
                          PID:3688
                        • C:\Windows\system32\wbem\unsecapp.exe
                          C:\Windows\system32\wbem\unsecapp.exe -Embedding
                          1⤵
                            PID:3100
                          • C:\Windows\system32\wbem\unsecapp.exe
                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                            1⤵
                              PID:1724
                            • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                              "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:2592
                            • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                              "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:3532
                            • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                              "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:2480
                            • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                              "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:2152
                            • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                              "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:4512
                            • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                              "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:2336
                            • C:\Windows\System32\SecurityHealthHost.exe
                              \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                              1⤵
                                PID:5616
                              • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                                "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:3496
                              • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                                "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                                1⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5652
                              • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                                "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:5984
                              • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                                "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                                1⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:2648
                              • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                                "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:4784
                              • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                                "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                                1⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:2320
                              • C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe
                                "C:\Users\Admin\AppData\Roaming\8B431EE270F1CAF2\8B431EE270F1CAF2.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:2784
                              • C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                                "C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe" -Embedding
                                1⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3384

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Command and Scripting Interpreter

                                    1
                                    T1059

                                    Windows Command Shell

                                    1
                                    T1059.003

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Active Setup

                                    1
                                    T1547.014

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Active Setup

                                    1
                                    T1547.014

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Defense Evasion

                                    Modify Registry

                                    5
                                    T1112

                                    Credential Access

                                    Credentials from Password Stores

                                    1
                                    T1555

                                    Credentials from Web Browsers

                                    1
                                    T1555.003

                                    Unsecured Credentials

                                    2
                                    T1552

                                    Credentials In Files

                                    2
                                    T1552.001

                                    Discovery

                                    Browser Information Discovery

                                    1
                                    T1217

                                    Peripheral Device Discovery

                                    2
                                    T1120

                                    Query Registry

                                    3
                                    T1012

                                    System Information Discovery

                                    3
                                    T1082

                                    System Location Discovery

                                    1
                                    T1614

                                    System Language Discovery

                                    1
                                    T1614.001

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    2
                                    T1005

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    ProtobufLite.dll
                                    • Path C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\ProtobufLite.dll
                                    • Size 509KB
                                    • SHA256 88509f3532f971f0b7731fc98a4dc543033282b31ff4af7549ddcbd7672dc823
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    eServiceHost.exe
                                    • Path C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\eServiceHost.exe
                                    • Size 1.2MB
                                    • SHA256 90157dc84e575a50cc539702f7f4232ac1e2d3dec4d710aaf01580b638efbf9e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    msvcp140.dll
                                    • Path C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\msvcp140.dll
                                    • Size 445KB
                                    • SHA256 aeef8186131390456d9ea415b07c0260a50ecc8dbdc7f3b3b833ea3511160756
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sciter-x.dll
                                    • Path C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\sciter-x.dll
                                    • Size 2.9MB
                                    • SHA256 beee609a02cc2372655cb1839bb6d4dcbbbcba5b25ee2205b80e6d6117e11481
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    vcruntime140.dll
                                    • Path C:\ProgramData\09378f14-4f77-4e5a-baac-0eb9e134a52d\vcruntime140.dll
                                    • Size 97KB
                                    • SHA256 c08e0bf24fe8e71f778249812eac99f6d4677eacc30d92c065a3da3f8011bd38
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    eServiceHost.exe
                                    • Path C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\eServiceHost.exe
                                    • Size 1.4MB
                                    • SHA256 1a0f96b14f2c091864948530b14d0dc277085767d3e9f9b2fa8faa062a0b6cd0
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sciter-x.dll
                                    • Path C:\ProgramData\7b83eab0-882c-4a07-bcb4-5fa65cf3a76b\sciter-x.dll
                                    • Size 4.9MB
                                    • SHA256 6e05b2349dff21bcbe0c875a71f7d209f4b689619cab67075f343777a5a6caaf
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    FnHotkeyUtility.exe
                                    • Path C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\FnHotkeyUtility.exe
                                    • Size 1.3MB
                                    • SHA256 2728e26af764a64dd31f6df20bad9ce68f27a1c54628abf7353a62f5e67a9dff
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    MSVCP140.dll
                                    • Path C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\MSVCP140.dll
                                    • Size 571KB
                                    • SHA256 a68a9ac35aa1e183fe3bd9e7144259631530db07502112a339e5e1c8dccc9a31
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    VCRUNTIME140_1.dll
                                    • Path C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\VCRUNTIME140_1.dll
                                    • Size 46KB
                                    • SHA256 e30874ceaf6b8dfe72ba67e5c1f21027d79cb3a873a32eb12c5ed89bfa660d1f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ludp.dll
                                    • Path C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\ludp.dll
                                    • Size 1.6MB
                                    • SHA256 a62f73b7cef738ebd9963744665aa85772b428aef214f07f8112ff3816b09241
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    spkvol.dll
                                    • Path C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\spkvol.dll
                                    • Size 6.5MB
                                    • SHA256 1c8138dd90f11e4af07c8ed375da0df563892d2ee4faa8f2b661a1aa2600a282
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    vcruntime140.dll
                                    • Path C:\ProgramData\9cde36b5-8801-40b4-8ab2-378a2730bd18\vcruntime140.dll
                                    • Size 101KB
                                    • SHA256 5dc711b1f190df5b1257b92883e9c3f10cb4e953591da13dd50d9f0c7a4af695
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    prep_Activatable Class_Hermes_perf.cache
                                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                    • Size 603B
                                    • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    prep_Activatable Class_Hermes_perf.cache
                                    • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                    • Size 607B
                                    • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    zipbvux.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-BK3JD.tmp\zipbvux.tmp
                                    • Size 3.3MB
                                    • SHA256 98166599c9e6322f7e95552f8c358ce1cffdb8e7c4cec1b96e689cf7f0c0744f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    aopbnixcn.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-H4BQC.tmp\aopbnixcn.tmp
                                    • Size 3.3MB
                                    • SHA256 bca5a36e5b00807f170c6d4fb4c9ab5944cc6a322da7af15babd3af78138b222
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ksobvux.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-HRJ6G.tmp\ksobvux.tmp
                                    • Size 3.3MB
                                    • SHA256 59453c9b443c47091a8002b6fe216d27daccbd7f9d0d62882a97bc104edba508
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    _setup64.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-ROTF4.tmp\_isetup\_setup64.tmp
                                    • Size 6KB
                                    • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    _isdecmp.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-UC2F9.tmp\_isetup\_isdecmp.dll
                                    • Size 34KB
                                    • SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    prefs.js
                                    • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\00wjakap.default-release\prefs.js
                                    • Size 7KB
                                    • SHA256 b6d93937630178479636ae42b046a3387e0c5852b37406258303a31bf309fb8b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    aopbnixcn.exe
                                    • Path C:\Users\Admin\AppData\Roaming\aopbnixcn.exe
                                    • Size 3.3MB
                                    • SHA256 191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    foipbiu.exe
                                    • Path C:\Users\Admin\AppData\Roaming\foipbiu.exe
                                    • Size 2.2MB
                                    • SHA256 a5870b765c6fc83f992d149e0f9acabc4fa8e66f23d6820f3ac46e9b9b4738c3
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    iovbuxv.exe
                                    • Path C:\Users\Admin\AppData\Roaming\iovbuxv.exe
                                    • Size 1.6MB
                                    • SHA256 1856e62e0584052f7eda8d92ceea178e388f1f4523ced62651921aa6bf8b41ce
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ksobvux.exe
                                    • Path C:\Users\Admin\AppData\Roaming\ksobvux.exe
                                    • Size 5.6MB
                                    • SHA256 5dfd68940c695a01548c0f75b755629b32b9809304312aeda3a9742a451012b4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    sxipcuzs.exe
                                    • Path C:\Users\Admin\AppData\Roaming\sxipcuzs.exe
                                    • Size 84KB
                                    • SHA256 336605c4dfea7f057ae668f84eef8af052c79a5ad458ebb72e93e81e86180888
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    syncappk.exe
                                    • Path C:\Users\Admin\AppData\Roaming\syncappk.exe
                                    • Size 32KB
                                    • SHA256 fc29828f2364921b3dfc7b30bbc5037901fd852bfc640679aec9ae04d9904547
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    zipbvux.exe
                                    • Path C:\Users\Admin\AppData\Roaming\zipbvux.exe
                                    • Size 3.5MB
                                    • SHA256 709a307bb850ab7d9f2d2692318c1594a2763ad4a5764d42b07a62aa6ef4bd00
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/200-459-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/300-79-0x0000000000FC0000-0x0000000001097000-memory.dmp
                                    Download

                                    memory/300-186-0x0000000000FC0000-0x0000000001097000-memory.dmp
                                    Download

                                    memory/300-213-0x0000000000FC0000-0x0000000001097000-memory.dmp
                                    Download

                                    memory/576-401-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/904-243-0x0000000000FC0000-0x0000000001097000-memory.dmp
                                    Download

                                    memory/904-208-0x0000000000FC0000-0x0000000001097000-memory.dmp
                                    Download

                                    memory/1184-698-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/1380-268-0x00007FF6C2EB0000-0x00007FF6C2F7C000-memory.dmp
                                    Download

                                    memory/1380-273-0x00007FF6C2EB0000-0x00007FF6C2F7C000-memory.dmp
                                    Download

                                    memory/1380-277-0x00007FF6C2EB0000-0x00007FF6C2F7C000-memory.dmp
                                    Download

                                    memory/2064-58-0x0000000000520000-0x00000000005FF000-memory.dmp
                                    Download

                                    memory/2064-110-0x0000000000520000-0x00000000005FF000-memory.dmp
                                    Download

                                    memory/2152-760-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/2168-190-0x00000000008A0000-0x0000000000C03000-memory.dmp
                                    Download

                                    memory/2168-210-0x00000000008A0000-0x0000000000C03000-memory.dmp
                                    Download

                                    memory/2168-206-0x00000000008A0000-0x0000000000C03000-memory.dmp
                                    Download

                                    memory/2320-841-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/2336-781-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/2336-776-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/2396-169-0x0000000000BB0000-0x0000000000F10000-memory.dmp
                                    Download

                                    memory/2532-313-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-305-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-195-0x00007FF718EE0000-0x00007FF719034000-memory.dmp
                                    Download

                                    memory/2532-332-0x00007FFB7ABC0000-0x00007FFB7AF94000-memory.dmp
                                    Download

                                    memory/2532-282-0x00007FFB7ABC0000-0x00007FFB7AF94000-memory.dmp
                                    Download

                                    memory/2532-317-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-316-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-311-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-245-0x00007FFB7ABC0000-0x00007FFB7AF94000-memory.dmp
                                    Download

                                    memory/2532-312-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-168-0x00007FFB7ABC0000-0x00007FFB7AF94000-memory.dmp
                                    Download

                                    memory/2532-198-0x00007FFB7ABC0000-0x00007FFB7AF94000-memory.dmp
                                    Download

                                    memory/2532-319-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-318-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-315-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2532-255-0x00007FFB7ABC0000-0x00007FFB7AF94000-memory.dmp
                                    Download

                                    memory/2532-314-0x0000000140000000-0x0000000140043000-memory.dmp
                                    Download

                                    memory/2632-90-0x0000000000FC0000-0x0000000001099000-memory.dmp
                                    Download

                                    memory/2632-21-0x0000000000FC0000-0x0000000001099000-memory.dmp
                                    Download

                                    memory/2648-821-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/3148-176-0x00000000003E0000-0x0000000000747000-memory.dmp
                                    Download

                                    memory/3172-335-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/3172-341-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/3204-442-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/3312-383-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/3384-861-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/3532-740-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/3624-105-0x0000000000D50000-0x00000000010B7000-memory.dmp
                                    Download

                                    memory/3640-170-0x0000000000FC0000-0x0000000001099000-memory.dmp
                                    Download

                                    memory/3640-86-0x0000000000FC0000-0x0000000001099000-memory.dmp
                                    Download

                                    memory/3688-703-0x00007FFB7A3E0000-0x00007FFB7A7B4000-memory.dmp
                                    Download

                                    memory/3688-696-0x00007FF718EE0000-0x00007FF719034000-memory.dmp
                                    Download

                                    memory/3688-695-0x00007FFB7A3E0000-0x00007FFB7A7B4000-memory.dmp
                                    Download

                                    memory/3792-101-0x0000000000520000-0x00000000005FF000-memory.dmp
                                    Download

                                    memory/3792-185-0x0000000000520000-0x00000000005FF000-memory.dmp
                                    Download

                                    memory/4164-129-0x0000000000490000-0x00000000004A9000-memory.dmp
                                    Download

                                    memory/4216-242-0x0000000000CB0000-0x0000000001013000-memory.dmp
                                    Download

                                    memory/4312-398-0x00007FFB880F0000-0x00007FFB884C4000-memory.dmp
                                    Download

                                    memory/4312-444-0x00007FFB880F0000-0x00007FFB884C4000-memory.dmp
                                    Download

                                    memory/4312-405-0x00007FFB880F0000-0x00007FFB884C4000-memory.dmp
                                    Download

                                    memory/4312-399-0x00007FF718EE0000-0x00007FF719034000-memory.dmp
                                    Download

                                    memory/4416-457-0x00007FF718EE0000-0x00007FF719034000-memory.dmp
                                    Download

                                    memory/4416-463-0x00007FFB880F0000-0x00007FFB884C4000-memory.dmp
                                    Download

                                    memory/4416-504-0x00007FFB880F0000-0x00007FFB884C4000-memory.dmp
                                    Download

                                    memory/4844-264-0x0000000073B60000-0x0000000073D47000-memory.dmp
                                    Download

                                    memory/4844-251-0x0000000005E10000-0x0000000005E62000-memory.dmp
                                    Download

                                    memory/4844-304-0x0000000073B60000-0x0000000073D47000-memory.dmp
                                    Download

                                    memory/4844-192-0x0000000073B60000-0x0000000073D47000-memory.dmp
                                    Download

                                    memory/4844-247-0x0000000073B60000-0x0000000073D47000-memory.dmp
                                    Download

                                    memory/4844-248-0x00000000031F0000-0x00000000033D2000-memory.dmp
                                    Download

                                    memory/4844-261-0x0000000006170000-0x00000000061AC000-memory.dmp
                                    Download

                                    memory/4844-181-0x0000000073B60000-0x0000000073D47000-memory.dmp
                                    Download

                                    memory/4844-252-0x00000000064B0000-0x0000000006A6A000-memory.dmp
                                    Download

                                    memory/4844-253-0x0000000005FA0000-0x0000000006032000-memory.dmp
                                    Download

                                    memory/4844-254-0x0000000005F80000-0x0000000005F8A000-memory.dmp
                                    Download

                                    memory/4844-262-0x00000000061B0000-0x00000000061FC000-memory.dmp
                                    Download

                                    memory/4844-258-0x0000000007090000-0x00000000076A8000-memory.dmp
                                    Download

                                    memory/4844-259-0x0000000006240000-0x000000000634A000-memory.dmp
                                    Download

                                    memory/4844-260-0x00000000060F0000-0x0000000006102000-memory.dmp
                                    Download

                                    memory/4896-87-0x0000000000500000-0x0000000000860000-memory.dmp
                                    Download

                                    memory/5072-339-0x00007FF718EE0000-0x00007FF719034000-memory.dmp
                                    Download

                                    memory/5072-338-0x00007FFB7AFE0000-0x00007FFB7B3B4000-memory.dmp
                                    Download

                                    memory/5072-346-0x00007FFB7AFE0000-0x00007FFB7B3B4000-memory.dmp
                                    Download

                                    memory/5072-385-0x00007FFB7AFE0000-0x00007FFB7B3B4000-memory.dmp
                                    Download

                                    memory/5276-502-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/5284-295-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-291-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-287-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-285-0x0000000003B00000-0x0000000003B41000-memory.dmp
                                    Download

                                    memory/5284-289-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-299-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-298-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-296-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-297-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-294-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-286-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-293-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-292-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-288-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5284-290-0x0000000003E60000-0x0000000003EA6000-memory.dmp
                                    Download

                                    memory/5304-249-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/5652-801-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/5896-284-0x0000000006130000-0x0000000006142000-memory.dmp
                                    Download

                                    memory/5896-257-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/5896-303-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/5896-246-0x0000000075460000-0x00000000755C7000-memory.dmp
                                    Download

                                    memory/5896-281-0x0000000003680000-0x0000000003722000-memory.dmp
                                    Download

                                    memory/5904-44-0x00007FF6C2EB0000-0x00007FF6C2F7C000-memory.dmp
                                    Download

                                    memory/5904-48-0x00007FF6C2EB0000-0x00007FF6C2F7C000-memory.dmp
                                    Download

                                    memory/5904-53-0x00007FF6C2EB0000-0x00007FF6C2F7C000-memory.dmp
                                    Download