Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/11/2021, 14:50

211110-r7nbvaeddr 10

08/11/2021, 16:12

211108-tnmmbahgaj 10

08/11/2021, 15:26

211108-svdsbaccf6 10

08/11/2021, 14:48

211108-r6lfvshdfn 10

Analysis

  • max time kernel
    1227s
  • max time network
    1250s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    08/11/2021, 16:12

General

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

Chris

C2

194.104.136.5:46013

Extracted

Family

redline

Botnet

media18

C2

91.121.67.60:2151

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

C2

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 9 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 1 IoCs
  • Xloader Payload 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 7 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 42 IoCs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Checks processor information in registry 2 TTPs 51 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 14 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3220
    • C:\Users\Admin\AppData\Local\Temp\4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe
      "C:\Users\Admin\AppData\Local\Temp\4d27dca0a1e05e876c2a1a8c09854c847b8e21bc5db294ad63cbfc603b5d62ef.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1344
        • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\setup_install.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4432
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2924
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2180
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2660
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Tue19879c4c0e.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2620
            • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19879c4c0e.exe
              Tue19879c4c0e.exe
              6⤵
              • Executes dropped EXE
              PID:5056
              • C:\Users\Admin\AppData\Local\Temp\is-9T9QM.tmp\Tue19879c4c0e.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-9T9QM.tmp\Tue19879c4c0e.tmp" /SL5="$20160,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19879c4c0e.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:3852
                • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19879c4c0e.exe
                  "C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19879c4c0e.exe" /SILENT
                  8⤵
                  • Executes dropped EXE
                  PID:5188
                  • C:\Users\Admin\AppData\Local\Temp\is-ATMRQ.tmp\Tue19879c4c0e.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-ATMRQ.tmp\Tue19879c4c0e.tmp" /SL5="$2021E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19879c4c0e.exe" /SILENT
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:5404
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Tue195c40958f528163.exe
            5⤵
              PID:4508
              • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue195c40958f528163.exe
                Tue195c40958f528163.exe
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:4948
                • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue195c40958f528163.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue195c40958f528163.exe
                  7⤵
                  • Executes dropped EXE
                  PID:5580
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue19f51bcd77a.exe
              5⤵
                PID:3784
                • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19f51bcd77a.exe
                  Tue19f51bcd77a.exe
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2520
                  • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19f51bcd77a.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19f51bcd77a.exe
                    7⤵
                    • Executes dropped EXE
                    PID:5552
                  • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19f51bcd77a.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19f51bcd77a.exe
                    7⤵
                    • Executes dropped EXE
                    PID:5832
                  • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19f51bcd77a.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19f51bcd77a.exe
                    7⤵
                    • Executes dropped EXE
                    PID:6116
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Tue19c06f159e0ec.exe
                5⤵
                  PID:4892
                  • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19c06f159e0ec.exe
                    Tue19c06f159e0ec.exe
                    6⤵
                    • Executes dropped EXE
                    PID:4828
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 300
                      7⤵
                      • Program crash
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      PID:2264
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Tue1993b3f72c.exe
                  5⤵
                    PID:3088
                    • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue1993b3f72c.exe
                      Tue1993b3f72c.exe
                      6⤵
                      • Executes dropped EXE
                      PID:4452
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Tue19150ee2be694c8a4.exe /mixone
                    5⤵
                      PID:3416
                      • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19150ee2be694c8a4.exe
                        Tue19150ee2be694c8a4.exe /mixone
                        6⤵
                        • Executes dropped EXE
                        PID:3104
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 300
                          7⤵
                          • Program crash
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          PID:416
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Tue19b4ef3b53293fe.exe
                      5⤵
                        PID:1564
                        • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19b4ef3b53293fe.exe
                          Tue19b4ef3b53293fe.exe
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4648
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1960
                            7⤵
                            • Program crash
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            PID:3236
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Tue1969586bcbf58493.exe
                        5⤵
                          PID:3184
                          • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue1969586bcbf58493.exe
                            Tue1969586bcbf58493.exe
                            6⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3812
                            • C:\Users\Admin\Pictures\Adobe Films\hz2zZEE1IO8UL8KkUIl_DiwJ.exe
                              "C:\Users\Admin\Pictures\Adobe Films\hz2zZEE1IO8UL8KkUIl_DiwJ.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:5684
                            • C:\Users\Admin\Pictures\Adobe Films\lmuaIti549S4IlfLGjOQ62Vi.exe
                              "C:\Users\Admin\Pictures\Adobe Films\lmuaIti549S4IlfLGjOQ62Vi.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:5232
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 5232 -s 296
                                8⤵
                                • Program crash
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:5648
                            • C:\Users\Admin\Pictures\Adobe Films\bogAMCgr_ceyHDpTDqaFFCso.exe
                              "C:\Users\Admin\Pictures\Adobe Films\bogAMCgr_ceyHDpTDqaFFCso.exe"
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of AdjustPrivilegeToken
                              PID:440
                            • C:\Users\Admin\Pictures\Adobe Films\dKb7nc_82MUnYJcIwvnENgPK.exe
                              "C:\Users\Admin\Pictures\Adobe Films\dKb7nc_82MUnYJcIwvnENgPK.exe"
                              7⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              PID:5384
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                8⤵
                                • Creates scheduled task(s)
                                PID:4508
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                8⤵
                                • Creates scheduled task(s)
                                PID:2620
                            • C:\Users\Admin\Pictures\Adobe Films\PzZpKoEf4kqLrhhG_T7hkMOE.exe
                              "C:\Users\Admin\Pictures\Adobe Films\PzZpKoEf4kqLrhhG_T7hkMOE.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:904
                            • C:\Users\Admin\Pictures\Adobe Films\OXLD9voH55f6gEm9L6axlvDX.exe
                              "C:\Users\Admin\Pictures\Adobe Films\OXLD9voH55f6gEm9L6axlvDX.exe"
                              7⤵
                              • Executes dropped EXE
                              • Checks BIOS information in registry
                              • Checks whether UAC is enabled
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              PID:4684
                            • C:\Users\Admin\Pictures\Adobe Films\Xhhrp4rIfn8tBtFfUngVP_kE.exe
                              "C:\Users\Admin\Pictures\Adobe Films\Xhhrp4rIfn8tBtFfUngVP_kE.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:3552
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 272
                                8⤵
                                • Program crash
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:6028
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Tue19761b3b8d9d.exe
                          5⤵
                            PID:2216
                            • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19761b3b8d9d.exe
                              Tue19761b3b8d9d.exe
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:3988
                              • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19761b3b8d9d.exe
                                C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19761b3b8d9d.exe
                                7⤵
                                • Executes dropped EXE
                                PID:5560
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c Tue19c1338f41ab.exe
                            5⤵
                              PID:5076
                              • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19c1338f41ab.exe
                                Tue19c1338f41ab.exe
                                6⤵
                                • Executes dropped EXE
                                PID:4896
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 308
                                  7⤵
                                  • Program crash
                                  • Checks processor information in registry
                                  • Enumerates system info in registry
                                  PID:3448
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Tue19c78ded4d176ac.exe
                              5⤵
                                PID:3484
                                • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19c78ded4d176ac.exe
                                  Tue19c78ded4d176ac.exe
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3332
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Tue19411ac950924ec3f.exe
                                5⤵
                                  PID:4016
                                  • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19411ac950924ec3f.exe
                                    Tue19411ac950924ec3f.exe
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3304
                                    • C:\Users\Admin\AppData\Roaming\8274515.exe
                                      "C:\Users\Admin\AppData\Roaming\8274515.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5740
                                    • C:\Users\Admin\AppData\Roaming\4775154.exe
                                      "C:\Users\Admin\AppData\Roaming\4775154.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:2052
                                    • C:\Users\Admin\AppData\Roaming\6218320.exe
                                      "C:\Users\Admin\AppData\Roaming\6218320.exe"
                                      7⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:2288
                                    • C:\Users\Admin\AppData\Roaming\7042039.exe
                                      "C:\Users\Admin\AppData\Roaming\7042039.exe"
                                      7⤵
                                        PID:5948
                                        • C:\Windows\SysWOW64\mshta.exe
                                          "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\7042039.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\7042039.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                          8⤵
                                            PID:3836
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\7042039.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\7042039.exe" ) do taskkill -f -Im "%~NXZ"
                                              9⤵
                                                PID:2644
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  taskkill -f -Im "7042039.exe"
                                                  10⤵
                                                  • Kills process with taskkill
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5224
                                                • C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe
                                                  ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i
                                                  10⤵
                                                  • Executes dropped EXE
                                                  PID:1540
                                                  • C:\Windows\SysWOW64\mshta.exe
                                                    "C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )
                                                    11⤵
                                                      PID:2752
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"
                                                        12⤵
                                                          PID:4008
                                                      • C:\Windows\SysWOW64\mshta.exe
                                                        "C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )
                                                        11⤵
                                                          PID:1300
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *
                                                            12⤵
                                                              PID:1560
                                                              • C:\Windows\System32\Conhost.exe
                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                13⤵
                                                                  PID:3240
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"
                                                                  13⤵
                                                                    PID:5836
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                                                    13⤵
                                                                    • Blocklisted process makes network request
                                                                    PID:4648
                                                                  • C:\Windows\SysWOW64\control.exe
                                                                    control ..\WfNRfms4.K
                                                                    13⤵
                                                                    • Executes dropped EXE
                                                                    PID:5948
                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                      14⤵
                                                                      • Loads dropped DLL
                                                                      PID:6000
                                                                      • C:\Windows\system32\RunDll32.exe
                                                                        C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K
                                                                        15⤵
                                                                          PID:3796
                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                            "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K
                                                                            16⤵
                                                                            • Loads dropped DLL
                                                                            PID:3572
                                                        • C:\Users\Admin\AppData\Roaming\435056.exe
                                                          "C:\Users\Admin\AppData\Roaming\435056.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          PID:5960
                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                            8⤵
                                                            • Executes dropped EXE
                                                            PID:4832
                                                        • C:\Users\Admin\AppData\Roaming\8581712.exe
                                                          "C:\Users\Admin\AppData\Roaming\8581712.exe"
                                                          7⤵
                                                          • Executes dropped EXE
                                                          PID:3504
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c Tue192762f1cd058ddf8.exe
                                                      5⤵
                                                        PID:3704
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue192762f1cd058ddf8.exe
                                                          Tue192762f1cd058ddf8.exe
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:2952
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c Tue193858933525b62.exe
                                                        5⤵
                                                          PID:3668
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue193858933525b62.exe
                                                            Tue193858933525b62.exe
                                                            6⤵
                                                            • Executes dropped EXE
                                                            PID:3316
                                                            • C:\Windows\SysWOW64\mshta.exe
                                                              "C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue193858933525b62.exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if """" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue193858933525b62.exe"" ) do taskkill -iM ""%~nXx"" /f " , 0 , TRuE ) )
                                                              7⤵
                                                                PID:1648
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue193858933525b62.exe" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "" == "" for %x In ( "C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue193858933525b62.exe") do taskkill -iM "%~nXx" /f
                                                                  8⤵
                                                                    PID:5448
                                                                    • C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe
                                                                      ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ
                                                                      9⤵
                                                                      • Executes dropped EXE
                                                                      PID:6012
                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                        "C:\Windows\System32\mshta.exe" VbscrIPt: CLOsE( crEATeObjEcT( "wsCRipt.SheLl" ). RUN ( "C:\Windows\system32\cmd.exe /q /C tYPe ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if ""-PyARgXd6fRp1GJRov7bdbpPssZBLJ "" == """" for %x In ( ""C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe"" ) do taskkill -iM ""%~nXx"" /f " , 0 , TRuE ) )
                                                                        10⤵
                                                                          PID:6128
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /q /C tYPe "C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe" > ~Xy1GPomKV09sC.Exe && stART ~Xy1gPomkV09sC.eXe -PyARgXd6fRp1GJRov7bdbpPssZBLJ &if "-PyARgXd6fRp1GJRov7bdbpPssZBLJ " == "" for %x In ( "C:\Users\Admin\AppData\Local\Temp\~Xy1GPomKV09sC.Exe") do taskkill -iM "%~nXx" /f
                                                                            11⤵
                                                                              PID:5336
                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                            "C:\Windows\System32\mshta.exe" vBscrIpt: cLosE ( cREatEObjEcT ( "wscript.sHeLl" ). Run ( "cMD.ExE /R ECHO | seT /P = ""MZ"" > F3U_R.J & CoPy /B /Y F3U_R.J + RqC~~.A + TfSAy.w + y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E & Start msiexec -Y .\bENCc.E " , 0 , TruE ) )
                                                                            10⤵
                                                                              PID:5732
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /R ECHO | seT /P = "MZ" >F3U_R.J & CoPy /B /Y F3U_R.J + RqC~~.A + TfSAy.w + y5ULsw.L6+ AobbVRP.2Y + WvAi.2 BENCc.E & Start msiexec -Y .\bENCc.E
                                                                                11⤵
                                                                                  PID:5272
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>F3U_R.J"
                                                                                    12⤵
                                                                                      PID:5656
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /S /D /c" ECHO "
                                                                                      12⤵
                                                                                        PID:3240
                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                        msiexec -Y .\bENCc.E
                                                                                        12⤵
                                                                                        • Loads dropped DLL
                                                                                        PID:4700
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill -iM "Tue193858933525b62.exe" /f
                                                                                  9⤵
                                                                                  • Kills process with taskkill
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:6060
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c Tue19325eb008c0b950.exe
                                                                          5⤵
                                                                            PID:4188
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 644
                                                                            5⤵
                                                                            • Program crash
                                                                            • Checks processor information in registry
                                                                            • Enumerates system info in registry
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5156
                                                                    • C:\Windows\SysWOW64\wlanext.exe
                                                                      "C:\Windows\SysWOW64\wlanext.exe"
                                                                      2⤵
                                                                      • Adds policy Run key to start application
                                                                      • Suspicious use of SetThreadContext
                                                                      • Drops file in Program Files directory
                                                                      • Modifies Internet Explorer settings
                                                                      • Suspicious behavior: MapViewOfSection
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:5792
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /c del "C:\Users\Admin\Pictures\Adobe Films\bogAMCgr_ceyHDpTDqaFFCso.exe"
                                                                        3⤵
                                                                          PID:4724
                                                                      • C:\Program Files (x86)\Y8pyhfft\lnz8vvkdnpkx.exe
                                                                        "C:\Program Files (x86)\Y8pyhfft\lnz8vvkdnpkx.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:2564
                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0450EC84\Tue19325eb008c0b950.exe
                                                                      Tue19325eb008c0b950.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      PID:4840
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1952 -ip 1952
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:840
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4648 -ip 4648
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:5728
                                                                    • C:\Windows\System32\WaaSMedicAgent.exe
                                                                      C:\Windows\System32\WaaSMedicAgent.exe a454731f9e1ab86af298c83b44bc0881 /wQZQ2ddR0eUW1NvDehkHw.0.1.0.3.0
                                                                      1⤵
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:5708
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4828 -ip 4828
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:1816
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5232 -ip 5232
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:4284
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3552 -ip 3552
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:5952
                                                                    • C:\Windows\system32\rundll32.exe
                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                      1⤵
                                                                      • Process spawned unexpected child process
                                                                      PID:2292
                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                        2⤵
                                                                        • Loads dropped DLL
                                                                        PID:468
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 904 -ip 904
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:3668
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 468 -ip 468
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:4336
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                      1⤵
                                                                      • Drops file in Windows directory
                                                                      • Modifies data under HKEY_USERS
                                                                      PID:5360
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3104 -ip 3104
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:5680
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                      1⤵
                                                                      • Checks processor information in registry
                                                                      PID:4796
                                                                      • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                        C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                        2⤵
                                                                          PID:2096
                                                                        • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                          C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
                                                                          2⤵
                                                                            PID:5884
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4896 -ip 4896
                                                                          1⤵
                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                          PID:2500
                                                                        • C:\Windows\System32\WaaSMedicAgent.exe
                                                                          C:\Windows\System32\WaaSMedicAgent.exe a454731f9e1ab86af298c83b44bc0881 /wQZQ2ddR0eUW1NvDehkHw.0.1.0.3.0
                                                                          1⤵
                                                                          • Modifies data under HKEY_USERS
                                                                          PID:5236

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • memory/440-392-0x0000000001670000-0x00000000019C6000-memory.dmp

                                                                          Filesize

                                                                          3.3MB

                                                                        • memory/440-403-0x0000000001610000-0x0000000001621000-memory.dmp

                                                                          Filesize

                                                                          68KB

                                                                        • memory/904-476-0x00000000020A0000-0x000000000211B000-memory.dmp

                                                                          Filesize

                                                                          492KB

                                                                        • memory/904-478-0x0000000002230000-0x0000000002305000-memory.dmp

                                                                          Filesize

                                                                          852KB

                                                                        • memory/1952-173-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/1952-166-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/1952-162-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                          Filesize

                                                                          572KB

                                                                        • memory/1952-164-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                          Filesize

                                                                          572KB

                                                                        • memory/1952-163-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                          Filesize

                                                                          572KB

                                                                        • memory/1952-165-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/1952-168-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/1952-169-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/1952-171-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/1952-174-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                          Filesize

                                                                          100KB

                                                                        • memory/1952-167-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                          Filesize

                                                                          1.5MB

                                                                        • memory/1952-170-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                          Filesize

                                                                          152KB

                                                                        • memory/2052-447-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2288-464-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2520-293-0x0000000004B60000-0x0000000004BD6000-memory.dmp

                                                                          Filesize

                                                                          472KB

                                                                        • memory/2520-255-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2520-308-0x00000000052F0000-0x00000000052F1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2564-580-0x0000000000CB0000-0x0000000001006000-memory.dmp

                                                                          Filesize

                                                                          3.3MB

                                                                        • memory/2660-263-0x0000000006CA0000-0x0000000006CA1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2660-320-0x0000000008440000-0x0000000008441000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2660-212-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2660-487-0x000000007F200000-0x000000007F201000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2660-329-0x00000000089E0000-0x00000000089E1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2660-306-0x0000000008030000-0x0000000008031000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2660-275-0x0000000007BA0000-0x0000000007BA1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2660-433-0x0000000006CA5000-0x0000000006CA7000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/2660-216-0x00000000047D0000-0x00000000047D1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2660-270-0x0000000006CA2000-0x0000000006CA3000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-438-0x00000000069E5000-0x00000000069E7000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/2924-223-0x0000000002C40000-0x0000000002C41000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-250-0x0000000007020000-0x0000000007021000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-296-0x00000000077A0000-0x00000000077A1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-269-0x00000000069E2000-0x00000000069E3000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-484-0x000000007F420000-0x000000007F421000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-260-0x00000000069E0000-0x00000000069E1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-295-0x0000000007810000-0x0000000007811000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-285-0x0000000006FC0000-0x0000000006FC1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-289-0x0000000007750000-0x0000000007751000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-241-0x00000000068F0000-0x00000000068F1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2924-215-0x0000000002C40000-0x0000000002C41000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/2952-314-0x00000172AD750000-0x00000172AD8B1000-memory.dmp

                                                                          Filesize

                                                                          1.4MB

                                                                        • memory/2952-312-0x00000172AD8F0000-0x00000172ADA4B000-memory.dmp

                                                                          Filesize

                                                                          1.4MB

                                                                        • memory/3104-535-0x0000000004C40000-0x0000000004C89000-memory.dmp

                                                                          Filesize

                                                                          292KB

                                                                        • memory/3104-242-0x000000000311D000-0x0000000003146000-memory.dmp

                                                                          Filesize

                                                                          164KB

                                                                        • memory/3220-406-0x0000000002C00000-0x0000000002CAD000-memory.dmp

                                                                          Filesize

                                                                          692KB

                                                                        • memory/3220-572-0x0000000004B90000-0x0000000004D1E000-memory.dmp

                                                                          Filesize

                                                                          1.6MB

                                                                        • memory/3304-273-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3304-274-0x0000000007000000-0x0000000007001000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3304-246-0x00000000000C0000-0x00000000000C1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3304-284-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3332-282-0x000000001ADF0000-0x000000001ADF2000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/3332-257-0x0000000000220000-0x0000000000221000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3504-466-0x0000000005720000-0x0000000005721000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3552-471-0x0000000002200000-0x0000000002277000-memory.dmp

                                                                          Filesize

                                                                          476KB

                                                                        • memory/3552-473-0x0000000002280000-0x0000000002303000-memory.dmp

                                                                          Filesize

                                                                          524KB

                                                                        • memory/3572-576-0x00000000052C0000-0x0000000005373000-memory.dmp

                                                                          Filesize

                                                                          716KB

                                                                        • memory/3812-301-0x0000000006270000-0x00000000063BC000-memory.dmp

                                                                          Filesize

                                                                          1.3MB

                                                                        • memory/3852-277-0x0000000000630000-0x0000000000631000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3988-264-0x0000000005660000-0x0000000005661000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3988-281-0x00000000057D0000-0x00000000057D1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3988-248-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/3988-278-0x0000000002F70000-0x0000000002F71000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4684-450-0x00000000058F0000-0x00000000058F1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4700-533-0x0000000004AA0000-0x0000000004B4C000-memory.dmp

                                                                          Filesize

                                                                          688KB

                                                                        • memory/4700-534-0x0000000004C00000-0x0000000004CAB000-memory.dmp

                                                                          Filesize

                                                                          684KB

                                                                        • memory/4828-418-0x0000000003410000-0x000000000349E000-memory.dmp

                                                                          Filesize

                                                                          568KB

                                                                        • memory/4828-259-0x000000000184B000-0x000000000189A000-memory.dmp

                                                                          Filesize

                                                                          316KB

                                                                        • memory/4832-531-0x0000000005720000-0x0000000005721000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4896-239-0x000000000310C000-0x0000000003115000-memory.dmp

                                                                          Filesize

                                                                          36KB

                                                                        • memory/4896-559-0x00000000030A0000-0x00000000030A9000-memory.dmp

                                                                          Filesize

                                                                          36KB

                                                                        • memory/4948-286-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/4948-249-0x00000000003C0000-0x00000000003C1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/5056-256-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                        • memory/5188-290-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                          Filesize

                                                                          80KB

                                                                        • memory/5232-460-0x00000000006E0000-0x0000000000707000-memory.dmp

                                                                          Filesize

                                                                          156KB

                                                                        • memory/5232-467-0x00000000020D0000-0x0000000002114000-memory.dmp

                                                                          Filesize

                                                                          272KB

                                                                        • memory/5404-315-0x00000000021A0000-0x00000000021A1000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/5560-362-0x0000000005510000-0x0000000005B28000-memory.dmp

                                                                          Filesize

                                                                          6.1MB

                                                                        • memory/5560-332-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                        • memory/5580-359-0x0000000005240000-0x0000000005858000-memory.dmp

                                                                          Filesize

                                                                          6.1MB

                                                                        • memory/5580-327-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                          Filesize

                                                                          136KB

                                                                        • memory/5740-371-0x0000000005400000-0x0000000005401000-memory.dmp

                                                                          Filesize

                                                                          4KB

                                                                        • memory/5792-442-0x0000000002EC0000-0x0000000002EE9000-memory.dmp

                                                                          Filesize

                                                                          164KB

                                                                        • memory/5792-440-0x00000000004F0000-0x0000000000507000-memory.dmp

                                                                          Filesize

                                                                          92KB

                                                                        • memory/5792-561-0x00000000034F0000-0x0000000003580000-memory.dmp

                                                                          Filesize

                                                                          576KB

                                                                        • memory/5792-468-0x0000000003620000-0x0000000003976000-memory.dmp

                                                                          Filesize

                                                                          3.3MB

                                                                        • memory/6000-567-0x0000000004F30000-0x0000000005113000-memory.dmp

                                                                          Filesize

                                                                          1.9MB

                                                                        • memory/6000-568-0x00000000051E0000-0x0000000005293000-memory.dmp

                                                                          Filesize

                                                                          716KB

                                                                        • memory/6116-391-0x0000000004DF0000-0x0000000005408000-memory.dmp

                                                                          Filesize

                                                                          6.1MB