Overview

overview

10

Static

static

BD6FE266F8...7B.exe

windows7_x64

10

BD6FE266F8...7B.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22/07/2021, 11:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BD6FE266F81A88ABE3C95129BD77757B.exe
  • Size 2.5MB
  • Sample210722-hakncxtka6
  • SHA256 ad059ada4911aa16829da483216cb466f07613edbc0f9f65a5ffd04ab1ea1732
  • MD5 SHA1 SHA512
Score
10/10
fickerstealerredlinesmokeloadersocelarsvidar933aninewaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

  • vidar

Version

  • 39.6

Botnet

  • 933

C2

  • https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://conceitosseg.com/upload/

  • http://integrasidata.com/upload/

  • http://ozentekstil.com/upload/

  • http://finbelportal.com/upload/

  • http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

  • redline

Botnet

  • AniNEW

C2

  • akedauiver.xyz:80

Extracted

Family

  • fickerstealer

C2

  • 37.0.8.225:80

Signatures

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Nirsoft 5 IoCs
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 64 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 13 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    evasion
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
      PID:1440
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2724
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2740
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2700
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2544
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2464
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1992
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1296
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1224
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1108
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:1064
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:340
                    • C:\Users\Admin\AppData\Local\Temp\BD6FE266F81A88ABE3C95129BD77757B.exe
                      "C:\Users\Admin\AppData\Local\Temp\BD6FE266F81A88ABE3C95129BD77757B.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:636
                      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1460
                        • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\setup_install.exe
                          "C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\setup_install.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:2676
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c arnatic_1.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1572
                            • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_1.exe
                              arnatic_1.exe
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:1664
                              • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_1.exe
                                "C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_1.exe" -a
                                6⤵
                                • Executes dropped EXE
                                PID:1264
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c arnatic_2.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2116
                            • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_2.exe
                              arnatic_2.exe
                              5⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: MapViewOfSection
                              PID:3208
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c arnatic_4.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3912
                            • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_4.exe
                              arnatic_4.exe
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:4060
                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                6⤵
                                • Executes dropped EXE
                                PID:3632
                                • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                  "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  PID:4812
                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                    8⤵
                                    • Executes dropped EXE
                                    PID:640
                                  • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                    C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                    8⤵
                                    • Executes dropped EXE
                                    PID:3956
                                • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                  "C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:4916
                                  • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                    C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                    8⤵
                                    • Executes dropped EXE
                                    PID:4556
                                • C:\Users\Admin\AppData\Local\Temp\setup 326.exe
                                  "C:\Users\Admin\AppData\Local\Temp\setup 326.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  • Drops file in Windows directory
                                  PID:5024
                                  • C:\Windows\winnetdriv.exe
                                    "C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626958665 0
                                    8⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:3200
                                • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:5096
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 804
                                    8⤵
                                    • Drops file in Windows directory
                                    • Program crash
                                    PID:1308
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 816
                                    8⤵
                                    • Loads dropped DLL
                                    • Program crash
                                    • Modifies registry class
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2236
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 896
                                    8⤵
                                    • Program crash
                                    PID:812
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1060
                                    8⤵
                                    • Program crash
                                    PID:5048
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1104
                                    8⤵
                                    • Program crash
                                    PID:4288
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1116
                                    8⤵
                                    • Program crash
                                    PID:4636
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1128
                                    8⤵
                                    • Suspicious use of NtCreateProcessExOtherParentProcess
                                    • Program crash
                                    PID:4880
                                • C:\Users\Admin\AppData\Local\Temp\zhangd.exe
                                  "C:\Users\Admin\AppData\Local\Temp\zhangd.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:3880
                                  • C:\Users\Admin\AppData\Local\Temp\zhangd.exe
                                    "C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a
                                    8⤵
                                    • Executes dropped EXE
                                    PID:4712
                                • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:4432
                                  • C:\Windows\system32\WerFault.exe
                                    C:\Windows\system32\WerFault.exe -u -p 4432 -s 1008
                                    8⤵
                                    • Program crash
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4484
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c arnatic_5.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3888
                            • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_5.exe
                              arnatic_5.exe
                              5⤵
                              • Executes dropped EXE
                              • Checks computer location settings
                              PID:756
                              • C:\Users\Admin\Documents\FZlmHLHBMAYspvpeAB4cuSio.exe
                                "C:\Users\Admin\Documents\FZlmHLHBMAYspvpeAB4cuSio.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:5088
                                • C:\Users\Admin\Documents\FZlmHLHBMAYspvpeAB4cuSio.exe
                                  C:\Users\Admin\Documents\FZlmHLHBMAYspvpeAB4cuSio.exe
                                  7⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks processor information in registry
                                  PID:4060
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im FZlmHLHBMAYspvpeAB4cuSio.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\FZlmHLHBMAYspvpeAB4cuSio.exe" & del C:\ProgramData\*.dll & exit
                                    8⤵
                                      PID:3768
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im FZlmHLHBMAYspvpeAB4cuSio.exe /f
                                        9⤵
                                        • Kills process with taskkill
                                        PID:1676
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        9⤵
                                        • Delays execution with timeout.exe
                                        PID:736
                                • C:\Users\Admin\Documents\SY1Bq45gJY317AotBPXBjrMN.exe
                                  "C:\Users\Admin\Documents\SY1Bq45gJY317AotBPXBjrMN.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  PID:4316
                                  • C:\Users\Admin\Documents\SY1Bq45gJY317AotBPXBjrMN.exe
                                    C:\Users\Admin\Documents\SY1Bq45gJY317AotBPXBjrMN.exe
                                    7⤵
                                    • Executes dropped EXE
                                    PID:644
                                • C:\Users\Admin\Documents\TnkCVM2LcnZzw8Betf552HbT.exe
                                  "C:\Users\Admin\Documents\TnkCVM2LcnZzw8Betf552HbT.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:3584
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c taskkill /f /im chrome.exe
                                    7⤵
                                      PID:5528
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        8⤵
                                        • Kills process with taskkill
                                        PID:4920
                                  • C:\Users\Admin\Documents\AvBAb3TUVxECkAsiaBZrpYfj.exe
                                    "C:\Users\Admin\Documents\AvBAb3TUVxECkAsiaBZrpYfj.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:4652
                                    • C:\Users\Admin\Documents\AvBAb3TUVxECkAsiaBZrpYfj.exe
                                      "C:\Users\Admin\Documents\AvBAb3TUVxECkAsiaBZrpYfj.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Checks SCSI registry key(s)
                                      • Suspicious behavior: MapViewOfSection
                                      PID:2844
                                  • C:\Users\Admin\Documents\8fnc4xUwaeTXXd1dGj6lL34X.exe
                                    "C:\Users\Admin\Documents\8fnc4xUwaeTXXd1dGj6lL34X.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:4476
                                    • C:\Users\Admin\Documents\8fnc4xUwaeTXXd1dGj6lL34X.exe
                                      C:\Users\Admin\Documents\8fnc4xUwaeTXXd1dGj6lL34X.exe
                                      7⤵
                                      • Executes dropped EXE
                                      PID:1248
                                  • C:\Users\Admin\Documents\eHA_aV5VvqtS2OQAV7QLi470.exe
                                    "C:\Users\Admin\Documents\eHA_aV5VvqtS2OQAV7QLi470.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:1824
                                    • C:\Users\Admin\Documents\eHA_aV5VvqtS2OQAV7QLi470.exe
                                      C:\Users\Admin\Documents\eHA_aV5VvqtS2OQAV7QLi470.exe
                                      7⤵
                                      • Executes dropped EXE
                                      PID:4488
                                  • C:\Users\Admin\Documents\RJecle53xkY38S3U0IYpvAaH.exe
                                    "C:\Users\Admin\Documents\RJecle53xkY38S3U0IYpvAaH.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    PID:196
                                    • C:\Users\Admin\Documents\RJecle53xkY38S3U0IYpvAaH.exe
                                      C:\Users\Admin\Documents\RJecle53xkY38S3U0IYpvAaH.exe
                                      7⤵
                                      • Executes dropped EXE
                                      PID:3404
                                  • C:\Users\Admin\Documents\iS6OgkyKJ235EubDGLhKhA77.exe
                                    "C:\Users\Admin\Documents\iS6OgkyKJ235EubDGLhKhA77.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:1520
                                    • C:\Users\Admin\AppData\Roaming\1234.exe
                                      C:\Users\Admin\AppData\Roaming\1234.exe 1234
                                      7⤵
                                      • Suspicious use of SetThreadContext
                                      PID:5804
                                      • C:\Users\Admin\AppData\Roaming\1234.exe
                                        "{path}"
                                        8⤵
                                          PID:1676
                                    • C:\Users\Admin\Documents\yqE41SSsjvNdBPu9SXlmXtf8.exe
                                      "C:\Users\Admin\Documents\yqE41SSsjvNdBPu9SXlmXtf8.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4108
                                      • C:\Users\Admin\AppData\Roaming\3231624.exe
                                        "C:\Users\Admin\AppData\Roaming\3231624.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5676
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 5676 -s 2060
                                          8⤵
                                          • Program crash
                                          PID:4712
                                      • C:\Users\Admin\AppData\Roaming\3816529.exe
                                        "C:\Users\Admin\AppData\Roaming\3816529.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:5744
                                    • C:\Users\Admin\Documents\_Lh4luoZD2eft5sY8gQam5xc.exe
                                      "C:\Users\Admin\Documents\_Lh4luoZD2eft5sY8gQam5xc.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:5036
                                      • C:\Users\Admin\Documents\_Lh4luoZD2eft5sY8gQam5xc.exe
                                        "C:\Users\Admin\Documents\_Lh4luoZD2eft5sY8gQam5xc.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Checks processor information in registry
                                        PID:1420
                                    • C:\Users\Admin\Documents\KaCT8MxlQghwWsqNsP766LY5.exe
                                      "C:\Users\Admin\Documents\KaCT8MxlQghwWsqNsP766LY5.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:2304
                                      • C:\Users\Admin\Documents\KaCT8MxlQghwWsqNsP766LY5.exe
                                        C:\Users\Admin\Documents\KaCT8MxlQghwWsqNsP766LY5.exe
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4260
                                    • C:\Users\Admin\Documents\VUcz0h91Jw_upSSVZVWnu2uM.exe
                                      "C:\Users\Admin\Documents\VUcz0h91Jw_upSSVZVWnu2uM.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:1660
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c cmd < Pura.vssm
                                        7⤵
                                          PID:5572
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd
                                            8⤵
                                              PID:5732
                                              • C:\Windows\SysWOW64\findstr.exe
                                                findstr /V /R "^mDHHnooFzwuKWdLxXAvOmqexElRneQaCvwawdMkcQdyHAkGxAHZauWenBjehsKCCIDhUYKrkfwXoVxUaEvXxRZvAZTAtJXtuNCYXYLvQENryYTDusKJU$" Cancellata.vssm
                                                9⤵
                                                  PID:5660
                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com
                                                  Bordatino.exe.com s
                                                  9⤵
                                                    PID:4732
                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com
                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bordatino.exe.com s
                                                      10⤵
                                                      • Drops startup file
                                                      PID:3852
                                                  • C:\Windows\SysWOW64\PING.EXE
                                                    ping 127.0.0.1 -n 30
                                                    9⤵
                                                    • Loads dropped DLL
                                                    • Modifies registry class
                                                    • Runs ping.exe
                                                    PID:5304
                                            • C:\Users\Admin\Documents\HOmaWk4ASYVbiA8E2nABk23q.exe
                                              "C:\Users\Admin\Documents\HOmaWk4ASYVbiA8E2nABk23q.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:3912
                                              • C:\Users\Admin\Documents\HOmaWk4ASYVbiA8E2nABk23q.exe
                                                C:\Users\Admin\Documents\HOmaWk4ASYVbiA8E2nABk23q.exe
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4936
                                              • C:\Users\Admin\Documents\HOmaWk4ASYVbiA8E2nABk23q.exe
                                                C:\Users\Admin\Documents\HOmaWk4ASYVbiA8E2nABk23q.exe
                                                7⤵
                                                  PID:5376
                                              • C:\Users\Admin\Documents\2JA4UnZiwvgm9zBXjM7P1PpC.exe
                                                "C:\Users\Admin\Documents\2JA4UnZiwvgm9zBXjM7P1PpC.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                PID:4212
                                              • C:\Users\Admin\Documents\pOHh6_CZNuD3pyKc1PHsuh4k.exe
                                                "C:\Users\Admin\Documents\pOHh6_CZNuD3pyKc1PHsuh4k.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:688
                                                • C:\Users\Admin\Documents\pOHh6_CZNuD3pyKc1PHsuh4k.exe
                                                  "C:\Users\Admin\Documents\pOHh6_CZNuD3pyKc1PHsuh4k.exe"
                                                  7⤵
                                                  • Modifies data under HKEY_USERS
                                                  PID:5664
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 688 -s 784
                                                  7⤵
                                                  • Program crash
                                                  PID:4320
                                              • C:\Users\Admin\Documents\Fr4EbBR8ZTzm_30Ql5PdHye9.exe
                                                "C:\Users\Admin\Documents\Fr4EbBR8ZTzm_30Ql5PdHye9.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                • Checks BIOS information in registry
                                                • Checks whether UAC is enabled
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                PID:4860
                                              • C:\Users\Admin\Documents\UgJP5af7_RRssaRDMBwfpuUA.exe
                                                "C:\Users\Admin\Documents\UgJP5af7_RRssaRDMBwfpuUA.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:4636
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "UgJP5af7_RRssaRDMBwfpuUA.exe" /f & erase "C:\Users\Admin\Documents\UgJP5af7_RRssaRDMBwfpuUA.exe" & exit
                                                  7⤵
                                                    PID:5916
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /im "UgJP5af7_RRssaRDMBwfpuUA.exe" /f
                                                      8⤵
                                                      • Kills process with taskkill
                                                      PID:3676
                                                • C:\Users\Admin\Documents\VR1NXR2MYmdLxqxUsqy0cTAD.exe
                                                  "C:\Users\Admin\Documents\VR1NXR2MYmdLxqxUsqy0cTAD.exe"
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Checks processor information in registry
                                                  PID:640
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im VR1NXR2MYmdLxqxUsqy0cTAD.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\VR1NXR2MYmdLxqxUsqy0cTAD.exe" & del C:\ProgramData\*.dll & exit
                                                    7⤵
                                                      PID:6028
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        taskkill /im VR1NXR2MYmdLxqxUsqy0cTAD.exe /f
                                                        8⤵
                                                        • Kills process with taskkill
                                                        PID:6052
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout /t 6
                                                        8⤵
                                                        • Delays execution with timeout.exe
                                                        PID:5484
                                                  • C:\Users\Admin\Documents\MTHm4u_4JYNqWzEfBGT7Tho5.exe
                                                    "C:\Users\Admin\Documents\MTHm4u_4JYNqWzEfBGT7Tho5.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Checks BIOS information in registry
                                                    • Checks whether UAC is enabled
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:4244
                                                  • C:\Users\Admin\Documents\AUnbll412xXcdWKbjyE3Pc1e.exe
                                                    "C:\Users\Admin\Documents\AUnbll412xXcdWKbjyE3Pc1e.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:4560
                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                      7⤵
                                                        PID:6016
                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                        7⤵
                                                          PID:4392
                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          7⤵
                                                            PID:5632
                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                            7⤵
                                                              PID:5000
                                                          • C:\Users\Admin\Documents\zE3KbYt8Rmfb1CniHj5oM3f5.exe
                                                            "C:\Users\Admin\Documents\zE3KbYt8Rmfb1CniHj5oM3f5.exe"
                                                            6⤵
                                                            • Executes dropped EXE
                                                            PID:5404
                                                            • C:\Users\Admin\Documents\zE3KbYt8Rmfb1CniHj5oM3f5.exe
                                                              "C:\Users\Admin\Documents\zE3KbYt8Rmfb1CniHj5oM3f5.exe" -a
                                                              7⤵
                                                                PID:5752
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c arnatic_3.exe
                                                          4⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1920
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_3.exe
                                                            arnatic_3.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Checks processor information in registry
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3176
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_3.exe" & del C:\ProgramData\*.dll & exit
                                                              6⤵
                                                                PID:4452
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  taskkill /im arnatic_3.exe /f
                                                                  7⤵
                                                                  • Kills process with taskkill
                                                                  PID:4836
                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                  timeout /t 6
                                                                  7⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:3676
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c arnatic_6.exe
                                                            4⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:868
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_6.exe
                                                              arnatic_6.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              PID:3200
                                                              • C:\Users\Admin\AppData\Roaming\7034172.exe
                                                                "C:\Users\Admin\AppData\Roaming\7034172.exe"
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3952
                                                                • C:\Windows\system32\WerFault.exe
                                                                  C:\Windows\system32\WerFault.exe -u -p 3952 -s 2024
                                                                  7⤵
                                                                  • Program crash
                                                                  PID:2116
                                                              • C:\Users\Admin\AppData\Roaming\4748637.exe
                                                                "C:\Users\Admin\AppData\Roaming\4748637.exe"
                                                                6⤵
                                                                  PID:2216
                                                                  • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                    "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:4824
                                                                • C:\Users\Admin\AppData\Roaming\8735429.exe
                                                                  "C:\Users\Admin\AppData\Roaming\8735429.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:2356
                                                                  • C:\Users\Admin\AppData\Roaming\8735429.exe
                                                                    C:\Users\Admin\AppData\Roaming\8735429.exe
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:1656
                                                                • C:\Users\Admin\AppData\Roaming\4024579.exe
                                                                  "C:\Users\Admin\AppData\Roaming\4024579.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:2680
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                              4⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1876
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4B5DB454\arnatic_7.exe
                                                                arnatic_7.exe
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:2232
                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:4888
                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • Adds Run key to start application
                                                                  PID:2216
                                                                • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:4340
                                                                • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:4836
                                                      • \??\c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                        1⤵
                                                        • Suspicious use of SetThreadContext
                                                        • Modifies data under HKEY_USERS
                                                        • Modifies registry class
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:916
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                          2⤵
                                                          • Drops file in System32 directory
                                                          • Checks processor information in registry
                                                          • Modifies data under HKEY_USERS
                                                          • Modifies registry class
                                                          PID:4176
                                                      • C:\Windows\system32\rUNdlL32.eXe
                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4076
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                          2⤵
                                                            PID:2236
                                                        • C:\Windows\system32\rUNdlL32.eXe
                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          PID:4592
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • Modifies registry class
                                                            PID:4948
                                                        • C:\Windows\system32\rUNdlL32.eXe
                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                          1⤵
                                                          • Process spawned unexpected child process
                                                          PID:5212
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                            2⤵
                                                              PID:5304
                                                          • \??\c:\windows\system32\svchost.exe
                                                            c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                            1⤵
                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                            PID:5852

                                                          Network

                                                                MITRE ATT&CK Enterprise v6

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                memory/196-431-0x0000000005650000-0x0000000005651000-memory.dmp
                                                                Download

                                                                memory/340-237-0x000001A14E380000-0x000001A14E3F1000-memory.dmp
                                                                Download

                                                                memory/340-349-0x000001A14EA50000-0x000001A14EAC1000-memory.dmp
                                                                Download

                                                                memory/916-346-0x000001B816C70000-0x000001B816CBC000-memory.dmp
                                                                Download

                                                                memory/916-219-0x000001B816CE0000-0x000001B816D51000-memory.dmp
                                                                Download

                                                                memory/916-211-0x000001B816C20000-0x000001B816C6C000-memory.dmp
                                                                Download

                                                                memory/916-339-0x000001B816F00000-0x000001B816F71000-memory.dmp
                                                                Download

                                                                memory/1064-369-0x000001E1F2BF0000-0x000001E1F2C61000-memory.dmp
                                                                Download

                                                                memory/1064-264-0x000001E1F2B70000-0x000001E1F2BE1000-memory.dmp
                                                                Download

                                                                memory/1108-367-0x000001FE3ECF0000-0x000001FE3ED61000-memory.dmp
                                                                Download

                                                                memory/1108-262-0x000001FE3EC70000-0x000001FE3ECE1000-memory.dmp
                                                                Download

                                                                memory/1224-272-0x00000220C3B70000-0x00000220C3BE1000-memory.dmp
                                                                Download

                                                                memory/1224-374-0x00000220C3C80000-0x00000220C3CF1000-memory.dmp
                                                                Download

                                                                memory/1296-261-0x0000021A3CF40000-0x0000021A3CFB1000-memory.dmp
                                                                Download

                                                                memory/1296-376-0x0000021A3D4A0000-0x0000021A3D511000-memory.dmp
                                                                Download

                                                                memory/1420-447-0x0000000000400000-0x000000000044E000-memory.dmp
                                                                Download

                                                                memory/1440-371-0x0000029F59100000-0x0000029F59171000-memory.dmp
                                                                Download

                                                                memory/1440-266-0x0000029F58ED0000-0x0000029F58F41000-memory.dmp
                                                                Download

                                                                memory/1656-404-0x0000000004FD0000-0x00000000055D6000-memory.dmp
                                                                Download

                                                                memory/1992-373-0x000001B4ED330000-0x000001B4ED3A1000-memory.dmp
                                                                Download

                                                                memory/1992-269-0x000001B4ED2B0000-0x000001B4ED321000-memory.dmp
                                                                Download

                                                                memory/2216-243-0x0000000009F90000-0x0000000009F91000-memory.dmp
                                                                Download

                                                                memory/2216-238-0x000000000A3F0000-0x000000000A3F1000-memory.dmp
                                                                Download

                                                                memory/2216-236-0x0000000004AD0000-0x0000000004ADB000-memory.dmp
                                                                Download

                                                                memory/2216-232-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
                                                                Download

                                                                memory/2216-210-0x0000000000230000-0x0000000000231000-memory.dmp
                                                                Download

                                                                memory/2216-246-0x0000000009F70000-0x0000000009F71000-memory.dmp
                                                                Download

                                                                memory/2216-335-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                Download

                                                                memory/2232-234-0x0000023C7E210000-0x0000023C7E2E1000-memory.dmp
                                                                Download

                                                                memory/2232-227-0x0000023C7DE00000-0x0000023C7DE70000-memory.dmp
                                                                Download

                                                                memory/2236-224-0x0000000000DC0000-0x0000000000E1D000-memory.dmp
                                                                Download

                                                                memory/2236-221-0x0000000004593000-0x0000000004694000-memory.dmp
                                                                Download

                                                                memory/2304-450-0x0000000004A20000-0x0000000004A96000-memory.dmp
                                                                Download

                                                                memory/2356-208-0x0000000000830000-0x0000000000831000-memory.dmp
                                                                Download

                                                                memory/2356-230-0x0000000005050000-0x0000000005051000-memory.dmp
                                                                Download

                                                                memory/2464-365-0x000001EFDCE40000-0x000001EFDCEB1000-memory.dmp
                                                                Download

                                                                memory/2464-260-0x000001EFDC930000-0x000001EFDC9A1000-memory.dmp
                                                                Download

                                                                memory/2544-258-0x000001E8ED360000-0x000001E8ED3D1000-memory.dmp
                                                                Download

                                                                memory/2544-360-0x000001E8ED9B0000-0x000001E8EDA21000-memory.dmp
                                                                Download

                                                                memory/2676-133-0x000000006B280000-0x000000006B2A6000-memory.dmp
                                                                Download

                                                                memory/2676-146-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                Download

                                                                memory/2676-144-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                Download

                                                                memory/2676-134-0x0000000000400000-0x000000000051E000-memory.dmp
                                                                Download

                                                                memory/2676-145-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                Download

                                                                memory/2676-132-0x000000006FE40000-0x000000006FFC6000-memory.dmp
                                                                Download

                                                                memory/2676-131-0x000000006B440000-0x000000006B4CF000-memory.dmp
                                                                Download

                                                                memory/2676-148-0x0000000064940000-0x0000000064959000-memory.dmp
                                                                Download

                                                                memory/2680-233-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
                                                                Download

                                                                memory/2680-270-0x0000000004E20000-0x0000000004E21000-memory.dmp
                                                                Download

                                                                memory/2680-252-0x0000000000E90000-0x0000000000E91000-memory.dmp
                                                                Download

                                                                memory/2680-249-0x0000000000E30000-0x0000000000E6E000-memory.dmp
                                                                Download

                                                                memory/2680-333-0x0000000007EF0000-0x0000000007EF1000-memory.dmp
                                                                Download

                                                                memory/2680-213-0x00000000005F0000-0x00000000005F1000-memory.dmp
                                                                Download

                                                                memory/2700-368-0x000001A597180000-0x000001A5971F1000-memory.dmp
                                                                Download

                                                                memory/2700-267-0x000001A597100000-0x000001A597171000-memory.dmp
                                                                Download

                                                                memory/2724-273-0x000001C9017D0000-0x000001C901841000-memory.dmp
                                                                Download

                                                                memory/2724-372-0x000001C901850000-0x000001C9018C1000-memory.dmp
                                                                Download

                                                                memory/2740-225-0x000002812EB30000-0x000002812EBA1000-memory.dmp
                                                                Download

                                                                memory/2740-344-0x000002812F040000-0x000002812F0B1000-memory.dmp
                                                                Download

                                                                memory/3052-325-0x00000000025C0000-0x00000000025D5000-memory.dmp
                                                                Download

                                                                memory/3176-206-0x0000000000400000-0x0000000000A00000-memory.dmp
                                                                Download

                                                                memory/3176-205-0x0000000002640000-0x00000000026DD000-memory.dmp
                                                                Download

                                                                memory/3200-174-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
                                                                Download

                                                                memory/3200-310-0x0000000000AD0000-0x0000000000BB4000-memory.dmp
                                                                Download

                                                                memory/3200-177-0x000000001B200000-0x000000001B202000-memory.dmp
                                                                Download

                                                                memory/3200-172-0x0000000000CC0000-0x0000000000CDA000-memory.dmp
                                                                Download

                                                                memory/3200-171-0x0000000000C90000-0x0000000000C91000-memory.dmp
                                                                Download

                                                                memory/3200-169-0x0000000000560000-0x0000000000561000-memory.dmp
                                                                Download

                                                                memory/3208-182-0x0000000000A90000-0x0000000000A99000-memory.dmp
                                                                Download

                                                                memory/3208-183-0x0000000000400000-0x00000000009A5000-memory.dmp
                                                                Download

                                                                memory/3632-209-0x0000000000920000-0x0000000000921000-memory.dmp
                                                                Download

                                                                memory/3952-217-0x000000001B240000-0x000000001B242000-memory.dmp
                                                                Download

                                                                memory/3952-203-0x0000000000C70000-0x0000000000CC0000-memory.dmp
                                                                Download

                                                                memory/3952-204-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
                                                                Download

                                                                memory/3952-198-0x0000000000C60000-0x0000000000C61000-memory.dmp
                                                                Download

                                                                memory/3952-190-0x0000000000510000-0x0000000000511000-memory.dmp
                                                                Download

                                                                memory/4060-166-0x0000000000D50000-0x0000000000D51000-memory.dmp
                                                                Download

                                                                memory/4060-173-0x0000000001500000-0x0000000001502000-memory.dmp
                                                                Download

                                                                memory/4108-435-0x000000001B940000-0x000000001B942000-memory.dmp
                                                                Download

                                                                memory/4176-392-0x000001F6B8400000-0x000001F6B8506000-memory.dmp
                                                                Download

                                                                memory/4176-391-0x000001F6B75B0000-0x000001F6B75CB000-memory.dmp
                                                                Download

                                                                memory/4176-235-0x000001F6B5D70000-0x000001F6B5DE1000-memory.dmp
                                                                Download

                                                                memory/4316-432-0x0000000004E40000-0x0000000004E41000-memory.dmp
                                                                Download

                                                                memory/4432-330-0x000001AFD43D0000-0x000001AFD43D1000-memory.dmp
                                                                Download

                                                                memory/4476-454-0x0000000004E70000-0x0000000004E71000-memory.dmp
                                                                Download

                                                                memory/4556-362-0x0000000004E00000-0x0000000005406000-memory.dmp
                                                                Download

                                                                memory/4556-342-0x0000000000400000-0x000000000041E000-memory.dmp
                                                                Download

                                                                memory/4556-354-0x0000000004E60000-0x0000000004E61000-memory.dmp
                                                                Download

                                                                memory/4556-351-0x0000000005410000-0x0000000005411000-memory.dmp
                                                                Download

                                                                memory/4824-316-0x000000000AF90000-0x000000000AF91000-memory.dmp
                                                                Download

                                                                memory/4824-324-0x0000000005970000-0x0000000005971000-memory.dmp
                                                                Download

                                                                memory/4888-287-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                Download

                                                                memory/4916-302-0x0000000000B50000-0x0000000000B51000-memory.dmp
                                                                Download

                                                                memory/4916-323-0x0000000005350000-0x0000000005351000-memory.dmp
                                                                Download

                                                                memory/4916-312-0x00000000053D0000-0x00000000053D1000-memory.dmp
                                                                Download

                                                                memory/4916-327-0x0000000002D10000-0x0000000002D11000-memory.dmp
                                                                Download

                                                                memory/4948-338-0x0000000004457000-0x0000000004558000-memory.dmp
                                                                Download

                                                                memory/4948-341-0x0000000004560000-0x00000000045BD000-memory.dmp
                                                                Download

                                                                memory/5024-294-0x0000000000400000-0x00000000004E4000-memory.dmp
                                                                Download

                                                                memory/5036-442-0x0000000000980000-0x00000000009C7000-memory.dmp
                                                                Download

                                                                memory/5096-363-0x0000000000400000-0x00000000009BE000-memory.dmp
                                                                Download

                                                                memory/5096-375-0x00000000009C0000-0x0000000000B0A000-memory.dmp
                                                                Download