Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    67s
  • max time network
    165s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    08/11/2021, 14:48

General

  • Target

    022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe

  • Size

    403KB

  • MD5

    f957e397e71010885b67f2afe37d8161

  • SHA1

    a8bf84b971b37ac6e7f66c5e5a7e971a7741401e

  • SHA256

    022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66

  • SHA512

    8b5e9cb926fafc295c403c1fce7aa883db3a327e58c3295e9a081a8937bed28e305cca08c2c7d98080818095ea99bb4047e10aa2f61e3e4d6d965aef6d16a4f6

Malware Config

Extracted

Family

socelars

C2

http://www.hhgenice.top/

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

C2

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

19425a9ea527ab0b3a94d8156a7d2f62d79d3b73

Attributes
  • url4cnc

    http://91.219.236.162/bimboDinotrex

    http://185.163.47.176/bimboDinotrex

    http://193.38.54.238/bimboDinotrex

    http://74.119.192.122/bimboDinotrex

    http://91.219.236.240/bimboDinotrex

    https://t.me/bimboDinotrex

rc4.plain
rc4.plain

Extracted

Family

redline

C2

45.9.20.149:10844

Extracted

Family

redline

Botnet

udptest

C2

193.56.146.64:65441

Extracted

Family

vidar

Version

47.9

Botnet

937

C2

https://mas.to/@kirpich

Attributes
  • profile_id

    937

Extracted

Family

smokeloader

Version

2020

C2

http://misha.at/upload/

http://roohaniinfra.com/upload/

http://0axqpcc.cn/upload/

http://mayak-lombard.ru/upload/

http://mebel-lass.ru/upload/

http://dishakhan.com/upload/

rc4.i32
rc4.i32

Extracted

Family

vidar

Version

47.9

Botnet

933

C2

https://mas.to/@kirpich

Attributes
  • profile_id

    933

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • Vidar Stealer 3 IoCs
  • Xloader Payload 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Modifies Windows Firewall 1 TTPs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • NSIS installer 4 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
    "C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Users\Admin\Pictures\Adobe Films\n3Tp8gFuqr5b2BLwWc7xUFAZ.exe
      "C:\Users\Admin\Pictures\Adobe Films\n3Tp8gFuqr5b2BLwWc7xUFAZ.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:908
    • C:\Users\Admin\Pictures\Adobe Films\PlcErVoRHEB8WDCnEhxZNLfo.exe
      "C:\Users\Admin\Pictures\Adobe Films\PlcErVoRHEB8WDCnEhxZNLfo.exe"
      2⤵
      • Executes dropped EXE
      PID:592
    • C:\Users\Admin\Pictures\Adobe Films\bvC0aBrVoiYJT2jZm8LdRil0.exe
      "C:\Users\Admin\Pictures\Adobe Films\bvC0aBrVoiYJT2jZm8LdRil0.exe"
      2⤵
      • Executes dropped EXE
      PID:1116
    • C:\Users\Admin\Pictures\Adobe Films\wFfzQhAyb9nNxvhU9xe3f5x4.exe
      "C:\Users\Admin\Pictures\Adobe Films\wFfzQhAyb9nNxvhU9xe3f5x4.exe"
      2⤵
      • Executes dropped EXE
      PID:1704
    • C:\Users\Admin\Pictures\Adobe Films\5l8ybXjb8Hy1OvCnudFUD2l8.exe
      "C:\Users\Admin\Pictures\Adobe Films\5l8ybXjb8Hy1OvCnudFUD2l8.exe"
      2⤵
      • Executes dropped EXE
      PID:1796
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:5876
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:5868
      • C:\Users\Admin\Documents\HNwrGPZhSvHpbgn0tQWPOxiQ.exe
        "C:\Users\Admin\Documents\HNwrGPZhSvHpbgn0tQWPOxiQ.exe"
        3⤵
          PID:5832
      • C:\Users\Admin\Pictures\Adobe Films\_Vm4titsrpvfv_Cfz_F9R_dZ.exe
        "C:\Users\Admin\Pictures\Adobe Films\_Vm4titsrpvfv_Cfz_F9R_dZ.exe"
        2⤵
        • Executes dropped EXE
        PID:1088
      • C:\Users\Admin\Pictures\Adobe Films\s1Ulg9ILOOmPW7fR22bhRf_C.exe
        "C:\Users\Admin\Pictures\Adobe Films\s1Ulg9ILOOmPW7fR22bhRf_C.exe"
        2⤵
        • Executes dropped EXE
        PID:676
        • C:\Users\Admin\Pictures\Adobe Films\s1Ulg9ILOOmPW7fR22bhRf_C.exe
          "C:\Users\Admin\Pictures\Adobe Films\s1Ulg9ILOOmPW7fR22bhRf_C.exe"
          3⤵
            PID:4428
        • C:\Users\Admin\Pictures\Adobe Films\gLt8wI1OI_X3ODtTGkM_mYnp.exe
          "C:\Users\Admin\Pictures\Adobe Films\gLt8wI1OI_X3ODtTGkM_mYnp.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:708
        • C:\Users\Admin\Pictures\Adobe Films\alNDOulU6UA92LJpYj8VwkbB.exe
          "C:\Users\Admin\Pictures\Adobe Films\alNDOulU6UA92LJpYj8VwkbB.exe"
          2⤵
          • Executes dropped EXE
          PID:348
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 1568
            3⤵
            • Program crash
            PID:5632
        • C:\Users\Admin\Pictures\Adobe Films\082l3_AoyLqJozglbfWQ3K9A.exe
          "C:\Users\Admin\Pictures\Adobe Films\082l3_AoyLqJozglbfWQ3K9A.exe"
          2⤵
          • Executes dropped EXE
          PID:2584
          • C:\Users\Admin\Pictures\Adobe Films\082l3_AoyLqJozglbfWQ3K9A.exe
            "C:\Users\Admin\Pictures\Adobe Films\082l3_AoyLqJozglbfWQ3K9A.exe"
            3⤵
              PID:5992
          • C:\Users\Admin\Pictures\Adobe Films\BWvifOluhbdVL7uVYPRyFdCe.exe
            "C:\Users\Admin\Pictures\Adobe Films\BWvifOluhbdVL7uVYPRyFdCe.exe"
            2⤵
            • Executes dropped EXE
            PID:2912
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
              3⤵
                PID:5072
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                3⤵
                  PID:4940
                • C:\Windows\System32\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                  3⤵
                    PID:2660
                  • C:\Windows\System32\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                    3⤵
                      PID:4304
                    • C:\Windows\System\svchost.exe
                      "C:\Windows\System\svchost.exe" formal
                      3⤵
                        PID:4552
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                          4⤵
                            PID:5168
                          • C:\Windows\System32\netsh.exe
                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                            4⤵
                              PID:2024
                            • C:\Windows\System32\netsh.exe
                              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                              4⤵
                                PID:5364
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                4⤵
                                  PID:6100
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                3⤵
                                • Creates scheduled task(s)
                                PID:4464
                            • C:\Users\Admin\Pictures\Adobe Films\UW7uXv2QjMlJPvjZEVNXbXzd.exe
                              "C:\Users\Admin\Pictures\Adobe Films\UW7uXv2QjMlJPvjZEVNXbXzd.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:1460
                            • C:\Users\Admin\Pictures\Adobe Films\gxJ1shjEWNmorQACeSGEJnDg.exe
                              "C:\Users\Admin\Pictures\Adobe Films\gxJ1shjEWNmorQACeSGEJnDg.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:3880
                              • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                                "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                                3⤵
                                  PID:2940
                              • C:\Users\Admin\Pictures\Adobe Films\8n4QpLYx11mbjWKzT1riKHm7.exe
                                "C:\Users\Admin\Pictures\Adobe Films\8n4QpLYx11mbjWKzT1riKHm7.exe"
                                2⤵
                                  PID:1048
                                  • C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe
                                    "C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"
                                    3⤵
                                      PID:4184
                                    • C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe
                                      "C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"
                                      3⤵
                                        PID:3956
                                        • C:\Users\Admin\AppData\Local\5919063.exe
                                          "C:\Users\Admin\AppData\Local\5919063.exe"
                                          4⤵
                                            PID:6036
                                          • C:\Users\Admin\AppData\Local\6615391.exe
                                            "C:\Users\Admin\AppData\Local\6615391.exe"
                                            4⤵
                                              PID:3944
                                            • C:\Users\Admin\AppData\Local\3674906.exe
                                              "C:\Users\Admin\AppData\Local\3674906.exe"
                                              4⤵
                                                PID:5620
                                                • C:\Windows\SysWOW64\mshta.exe
                                                  "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\3674906.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\3674906.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                  5⤵
                                                    PID:5636
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\3674906.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\3674906.exe" ) do taskkill -f -Im "%~NXZ"
                                                      6⤵
                                                        PID:4160
                                                  • C:\Users\Admin\AppData\Local\4586976.exe
                                                    "C:\Users\Admin\AppData\Local\4586976.exe"
                                                    4⤵
                                                      PID:2192
                                                      • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                        5⤵
                                                          PID:4648
                                                      • C:\Users\Admin\AppData\Local\6969289.exe
                                                        "C:\Users\Admin\AppData\Local\6969289.exe"
                                                        4⤵
                                                          PID:5444
                                                      • C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"
                                                        3⤵
                                                          PID:4376
                                                        • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                          3⤵
                                                            PID:4544
                                                            • C:\Windows\SysWOW64\mshta.exe
                                                              "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                              4⤵
                                                                PID:3064
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                                  5⤵
                                                                    PID:4584
                                                                    • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                      ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                      6⤵
                                                                        PID:6040
                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                          "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                          7⤵
                                                                            PID:5696
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                              8⤵
                                                                                PID:6076
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill -f -iM "search_hyperfs_206.exe"
                                                                            6⤵
                                                                            • Kills process with taskkill
                                                                            PID:4516
                                                                    • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                      3⤵
                                                                        PID:4780
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-6918G.tmp\setup.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-6918G.tmp\setup.tmp" /SL5="$102AA,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                          4⤵
                                                                            PID:5084
                                                                            • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                              5⤵
                                                                                PID:2304
                                                                          • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                                            3⤵
                                                                              PID:4976
                                                                            • C:\Users\Admin\AppData\Local\Temp\askinstall25.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"
                                                                              3⤵
                                                                                PID:4296
                                                                              • C:\Users\Admin\AppData\Local\Temp\setup_2.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\setup_2.exe"
                                                                                3⤵
                                                                                  PID:4488
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 656
                                                                                    4⤵
                                                                                    • Program crash
                                                                                    PID:5628
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 668
                                                                                    4⤵
                                                                                    • Program crash
                                                                                    PID:6048
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 672
                                                                                    4⤵
                                                                                    • Program crash
                                                                                    PID:5768
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4488 -s 684
                                                                                    4⤵
                                                                                    • Program crash
                                                                                    PID:5404
                                                                                • C:\Users\Admin\AppData\Local\Temp\chrome update.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\chrome update.exe"
                                                                                  3⤵
                                                                                    PID:1232
                                                                                  • C:\Users\Admin\AppData\Local\Temp\chrome2.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\chrome2.exe"
                                                                                    3⤵
                                                                                      PID:5152
                                                                                    • C:\Users\Admin\AppData\Local\Temp\chrome1.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\chrome1.exe"
                                                                                      3⤵
                                                                                        PID:5116
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                                        3⤵
                                                                                          PID:2316
                                                                                      • C:\Users\Admin\Pictures\Adobe Films\QOuEBFzOMIfUDYz7ij2u_fba.exe
                                                                                        "C:\Users\Admin\Pictures\Adobe Films\QOuEBFzOMIfUDYz7ij2u_fba.exe"
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1848
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im "QOuEBFzOMIfUDYz7ij2u_fba.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\QOuEBFzOMIfUDYz7ij2u_fba.exe" & exit
                                                                                          3⤵
                                                                                            PID:1188
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /im "QOuEBFzOMIfUDYz7ij2u_fba.exe" /f
                                                                                              4⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:6112
                                                                                        • C:\Users\Admin\Pictures\Adobe Films\9XkBG2Fij6lRQQg2VdDCFVDq.exe
                                                                                          "C:\Users\Admin\Pictures\Adobe Films\9XkBG2Fij6lRQQg2VdDCFVDq.exe"
                                                                                          2⤵
                                                                                            PID:1944
                                                                                          • C:\Users\Admin\Pictures\Adobe Films\RDUUnu6sCbpiWGkN78DH5kei.exe
                                                                                            "C:\Users\Admin\Pictures\Adobe Films\RDUUnu6sCbpiWGkN78DH5kei.exe"
                                                                                            2⤵
                                                                                              PID:3780
                                                                                            • C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe
                                                                                              "C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe"
                                                                                              2⤵
                                                                                                PID:3496
                                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                                  "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                  3⤵
                                                                                                    PID:2108
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\68e2VhFSAP0FRPMi5EQ4pv5v.exe" ) do taskkill -im "%~NxK" -F
                                                                                                      4⤵
                                                                                                        PID:4444
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\8pWB.eXE
                                                                                                          8pWB.eXe /pO_wtib1KE0hzl7U9_CYP
                                                                                                          5⤵
                                                                                                            PID:5480
                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                              "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )
                                                                                                              6⤵
                                                                                                                PID:5712
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F
                                                                                                                  7⤵
                                                                                                                    PID:5892
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                taskkill -im "68e2VhFSAP0FRPMi5EQ4pv5v.exe" -F
                                                                                                                5⤵
                                                                                                                • Kills process with taskkill
                                                                                                                PID:6132
                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\s2BraH1hwSN7ptT8LosdeIhg.exe
                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\s2BraH1hwSN7ptT8LosdeIhg.exe"
                                                                                                          2⤵
                                                                                                            PID:2092
                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\XJIx4bsaRMD60GuFjnfMnAwT.exe
                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\XJIx4bsaRMD60GuFjnfMnAwT.exe"
                                                                                                            2⤵
                                                                                                              PID:748
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\XJIx4bsaRMD60GuFjnfMnAwT.exe" & exit
                                                                                                                3⤵
                                                                                                                  PID:2304
                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\X18gHmQuxYkxHF4yyIXSTF1v.exe
                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\X18gHmQuxYkxHF4yyIXSTF1v.exe"
                                                                                                                2⤵
                                                                                                                  PID:2600
                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\xTqlEgwCYq9KaBFguTTHn165.exe
                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\xTqlEgwCYq9KaBFguTTHn165.exe"
                                                                                                                  2⤵
                                                                                                                    PID:2552
                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\xTqlEgwCYq9KaBFguTTHn165.exe
                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\xTqlEgwCYq9KaBFguTTHn165.exe"
                                                                                                                      3⤵
                                                                                                                        PID:4392
                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\fAxb2uj1hqYE940HxUi2Oq8V.exe
                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\fAxb2uj1hqYE940HxUi2Oq8V.exe"
                                                                                                                      2⤵
                                                                                                                        PID:1436
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                          C:\Users\Admin\AppData\Roaming\Underdress.exe
                                                                                                                          3⤵
                                                                                                                            PID:1252
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"
                                                                                                                              4⤵
                                                                                                                                PID:2120
                                                                                                                            • C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                              C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe
                                                                                                                              3⤵
                                                                                                                                PID:772
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:4652
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 552
                                                                                                                                    4⤵
                                                                                                                                    • Program crash
                                                                                                                                    PID:5048
                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\fQ3PKz0AGUetIsFf1bPP0E8B.exe
                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\fQ3PKz0AGUetIsFf1bPP0E8B.exe"
                                                                                                                                2⤵
                                                                                                                                  PID:916
                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\Sl1_ExVycKO8zgHCVnimQ8b5.exe
                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\Sl1_ExVycKO8zgHCVnimQ8b5.exe"
                                                                                                                                  2⤵
                                                                                                                                    PID:1352
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 892
                                                                                                                                      3⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:4700
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\rbleiDRuuTxWNVSwHhQLgw9o.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\rbleiDRuuTxWNVSwHhQLgw9o.exe"
                                                                                                                                    2⤵
                                                                                                                                      PID:3048
                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\i2M5jnBZQI0VGz8B0Jb920CZ.exe
                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\i2M5jnBZQI0VGz8B0Jb920CZ.exe"
                                                                                                                                      2⤵
                                                                                                                                        PID:4728
                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                      "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                      1⤵
                                                                                                                                        PID:3672
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          /c del "C:\Users\Admin\Pictures\Adobe Films\UW7uXv2QjMlJPvjZEVNXbXzd.exe"
                                                                                                                                          2⤵
                                                                                                                                            PID:4812
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-OV261.tmp\setup.tmp
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-OV261.tmp\setup.tmp" /SL5="$202C0,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT
                                                                                                                                          1⤵
                                                                                                                                            PID:4920
                                                                                                                                            • C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe
                                                                                                                                              "C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart
                                                                                                                                              2⤵
                                                                                                                                                PID:4304
                                                                                                                                                • C:\b19e86d2a6a5072ffa94\Setup.exe
                                                                                                                                                  C:\b19e86d2a6a5072ffa94\\Setup.exe /q /norestart /x86 /x64 /web
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5852
                                                                                                                                                • C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe
                                                                                                                                                  "C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3280
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-C6637.tmp\postback.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-C6637.tmp\postback.exe" ss1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2996

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • memory/348-287-0x0000000000400000-0x00000000004D9000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    868KB

                                                                                                                                                  • memory/348-274-0x0000000000770000-0x00000000007EC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    496KB

                                                                                                                                                  • memory/592-267-0x0000000002420000-0x000000000244E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    184KB

                                                                                                                                                  • memory/592-325-0x0000000000470000-0x000000000051E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    696KB

                                                                                                                                                  • memory/592-316-0x0000000002484000-0x0000000002486000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/592-285-0x0000000002450000-0x000000000247C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    176KB

                                                                                                                                                  • memory/592-256-0x00000000001C0000-0x00000000001EB000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                  • memory/592-276-0x0000000004B10000-0x0000000004B11000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/676-200-0x0000000000C60000-0x0000000000C61000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/676-215-0x00000000054A0000-0x00000000054A1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/676-228-0x0000000005440000-0x0000000005441000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/676-232-0x0000000005610000-0x0000000005611000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/772-321-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.1MB

                                                                                                                                                  • memory/772-224-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.1MB

                                                                                                                                                  • memory/772-238-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.1MB

                                                                                                                                                  • memory/772-231-0x0000000000400000-0x000000000091D000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.1MB

                                                                                                                                                  • memory/916-249-0x00000000011F0000-0x00000000011F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1048-196-0x0000000000400000-0x0000000000401000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1088-288-0x00000000055A0000-0x00000000055A1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1088-251-0x0000000005630000-0x0000000005631000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1088-227-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1088-270-0x0000000005560000-0x0000000005561000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1088-209-0x0000000077280000-0x000000007740E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.6MB

                                                                                                                                                  • memory/1088-247-0x0000000005500000-0x0000000005501000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1088-240-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1116-138-0x0000000002650000-0x00000000026B0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    384KB

                                                                                                                                                  • memory/1232-410-0x000000001B4F0000-0x000000001B4F2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/1460-219-0x0000000001890000-0x00000000018A1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    68KB

                                                                                                                                                  • memory/1704-330-0x0000000000400000-0x0000000000442000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    264KB

                                                                                                                                                  • memory/1704-313-0x00000000001D0000-0x00000000001D9000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    36KB

                                                                                                                                                  • memory/1704-250-0x00000000001C0000-0x00000000001C9000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    36KB

                                                                                                                                                  • memory/1848-281-0x0000000000650000-0x0000000000677000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    156KB

                                                                                                                                                  • memory/1944-248-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/1944-216-0x0000000077280000-0x000000007740E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.6MB

                                                                                                                                                  • memory/2092-294-0x00000000001E0000-0x00000000001F4000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    80KB

                                                                                                                                                  • memory/2120-414-0x000002B4787F0000-0x000002B4787F2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/2120-279-0x000002B478240000-0x000002B478241000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2304-390-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    80KB

                                                                                                                                                  • memory/2600-225-0x0000000002850000-0x0000000002851000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-239-0x0000000002870000-0x0000000002871000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-359-0x0000000003570000-0x0000000003571000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-392-0x0000000003560000-0x0000000003561000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-431-0x0000000000D30000-0x0000000000D31000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-242-0x0000000002880000-0x0000000002881000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-357-0x00000000028B0000-0x00000000028B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-207-0x0000000002860000-0x0000000002861000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-264-0x0000000003B00000-0x0000000003B01000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-430-0x0000000002670000-0x0000000002671000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-385-0x0000000003560000-0x0000000003561000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-204-0x00000000028A0000-0x00000000028A1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-366-0x0000000003560000-0x0000000003561000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-425-0x0000000000880000-0x0000000000881000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-341-0x0000000002890000-0x0000000002891000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-422-0x0000000000D20000-0x0000000000D21000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-412-0x0000000003560000-0x0000000003561000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-345-0x00000000028C0000-0x00000000028C1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-419-0x0000000002680000-0x0000000002681000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-299-0x0000000003B04000-0x0000000003B05000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/2600-258-0x0000000003980000-0x0000000003999000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    100KB

                                                                                                                                                  • memory/2600-213-0x0000000003660000-0x000000000368E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    184KB

                                                                                                                                                  • memory/2600-189-0x0000000000810000-0x000000000086F000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    380KB

                                                                                                                                                  • memory/2912-254-0x0000000140000000-0x0000000140FFB000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/3004-333-0x00000000008A0000-0x00000000008B6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    88KB

                                                                                                                                                  • memory/3048-306-0x0000000000460000-0x000000000050E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    696KB

                                                                                                                                                  • memory/3664-118-0x0000000005FA0000-0x00000000060EC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.3MB

                                                                                                                                                  • memory/3672-319-0x0000000005450000-0x0000000005770000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    3.1MB

                                                                                                                                                  • memory/3780-188-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/3780-212-0x000000001B910000-0x000000001B912000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/3780-203-0x0000000001430000-0x0000000001431000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/3956-295-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/3956-261-0x00000000009B0000-0x00000000009B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/3956-311-0x00000000051F0000-0x00000000051F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/4184-378-0x00000000022C0000-0x0000000002396000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    856KB

                                                                                                                                                  • memory/4184-372-0x00000000004E0000-0x000000000062A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.3MB

                                                                                                                                                  • memory/4184-383-0x0000000000400000-0x00000000004D9000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    868KB

                                                                                                                                                  • memory/4392-296-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                  • memory/4428-363-0x0000000005070000-0x0000000005676000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.0MB

                                                                                                                                                  • memory/4488-434-0x0000000000400000-0x000000000046A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    424KB

                                                                                                                                                  • memory/4488-433-0x0000000000570000-0x00000000006BA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.3MB

                                                                                                                                                  • memory/4544-315-0x0000000002330000-0x0000000002331000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/4652-374-0x0000000006D10000-0x0000000006D11000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/4780-337-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    80KB

                                                                                                                                                  • memory/4920-416-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/4940-404-0x0000023FCD5B3000-0x0000023FCD5B5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/4940-396-0x0000023FCD5B0000-0x0000023FCD5B2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/4976-352-0x0000000000560000-0x0000000000572000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    72KB

                                                                                                                                                  • memory/4976-349-0x00000000001E0000-0x00000000001F0000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    64KB

                                                                                                                                                  • memory/5072-400-0x000002A77A640000-0x000002A77A642000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/5072-406-0x000002A77A643000-0x000002A77A645000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/5084-370-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                  • memory/5116-401-0x000000001B290000-0x000000001B292000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                  • memory/5152-426-0x000000001B520000-0x000000001B522000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB