Analysis

  • max time kernel
    41s
  • max time network
    157s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    23/12/2021, 13:27

General

  • Target

    2cf4059fbbb6c4a47cb245974bd7a7ef8702c4ebf30b8e18439b1930088b773e.exe

  • Size

    7.0MB

  • MD5

    e3377587921b08dbf82f1c517c46c771

  • SHA1

    d6a64cfc0d0965a2138c1711db9068c05edbbf99

  • SHA256

    2cf4059fbbb6c4a47cb245974bd7a7ef8702c4ebf30b8e18439b1930088b773e

  • SHA512

    a35bc53bb085406e65258fd9493c447b1b555fb292b8629832d23a49f55cb8c684c19c601187bc1062b19405d3260773874f98fb0338d8f82e612efc127a869e

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.2

Botnet

915

C2

https://mstdn.social/@kipriauk9

https://qoto.org/@kipriauk8

Attributes
  • profile_id

    915

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

media22ns

C2

65.108.69.168:13293

Extracted

Family

redline

Botnet

userv1

C2

159.69.246.184:13127

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 9 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 8 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 23 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 7 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 4 IoCs
  • Modifies registry class 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cf4059fbbb6c4a47cb245974bd7a7ef8702c4ebf30b8e18439b1930088b773e.exe
    "C:\Users\Admin\AppData\Local\Temp\2cf4059fbbb6c4a47cb245974bd7a7ef8702c4ebf30b8e18439b1930088b773e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4568
      • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
            PID:592
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4972
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
              PID:648
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:792
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu0496e1dd7fba63.exe /mixtwo
              4⤵
                PID:912
                • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0496e1dd7fba63.exe
                  Thu0496e1dd7fba63.exe /mixtwo
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3244
                  • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0496e1dd7fba63.exe
                    Thu0496e1dd7fba63.exe /mixtwo
                    6⤵
                    • Executes dropped EXE
                    PID:1816
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c taskkill /im "Thu0496e1dd7fba63.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0496e1dd7fba63.exe" & exit
                      7⤵
                        PID:3696
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /im "Thu0496e1dd7fba63.exe" /f
                          8⤵
                          • Kills process with taskkill
                          PID:3996
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Thu045bf6b666088d.exe
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:920
                  • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu045bf6b666088d.exe
                    Thu045bf6b666088d.exe
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2700
                    • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu045bf6b666088d.exe
                      C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu045bf6b666088d.exe
                      6⤵
                        PID:5108
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Thu047d85274a427.exe
                    4⤵
                      PID:416
                      • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu047d85274a427.exe
                        Thu047d85274a427.exe
                        5⤵
                        • Executes dropped EXE
                        PID:816
                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          6⤵
                          • Executes dropped EXE
                          PID:1032
                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                          C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          6⤵
                            PID:4460
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Thu04ab2fb4f7.exe
                        4⤵
                          PID:1452
                          • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04ab2fb4f7.exe
                            Thu04ab2fb4f7.exe
                            5⤵
                            • Executes dropped EXE
                            PID:5056
                            • C:\Windows\SysWOW64\control.exe
                              "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\c33Ko.Cpl",
                              6⤵
                                PID:4436
                                • C:\Windows\SysWOW64\rundll32.exe
                                  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\c33Ko.Cpl",
                                  7⤵
                                    PID:1856
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c Thu04a1df34ace0e8.exe
                              4⤵
                                PID:1640
                                • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04a1df34ace0e8.exe
                                  Thu04a1df34ace0e8.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:2268
                                  • C:\Users\Admin\Pictures\Adobe Films\Bl5loTl_xiDJNDk_xTItNPZR.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\Bl5loTl_xiDJNDk_xTItNPZR.exe"
                                    6⤵
                                      PID:3608
                                    • C:\Users\Admin\Pictures\Adobe Films\xCVvs7awf52bSGamC2Wt9DPh.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\xCVvs7awf52bSGamC2Wt9DPh.exe"
                                      6⤵
                                        PID:3416
                                      • C:\Users\Admin\Pictures\Adobe Films\Y8hC_G5w_clPe8qICnhQoLsv.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\Y8hC_G5w_clPe8qICnhQoLsv.exe"
                                        6⤵
                                          PID:1076
                                        • C:\Users\Admin\Pictures\Adobe Films\x52Xk9FRHgDwZQxtBLLTkXJJ.exe
                                          "C:\Users\Admin\Pictures\Adobe Films\x52Xk9FRHgDwZQxtBLLTkXJJ.exe"
                                          6⤵
                                            PID:4040
                                          • C:\Users\Admin\Pictures\Adobe Films\AYd49CGpQeBTxMgdogAX4TYS.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\AYd49CGpQeBTxMgdogAX4TYS.exe"
                                            6⤵
                                              PID:4544
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                7⤵
                                                • Creates scheduled task(s)
                                                PID:5836
                                              • C:\Windows\SysWOW64\schtasks.exe
                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                7⤵
                                                • Creates scheduled task(s)
                                                PID:5800
                                            • C:\Users\Admin\Pictures\Adobe Films\GYUx2tBb67yYwGAoFuaWSNlU.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\GYUx2tBb67yYwGAoFuaWSNlU.exe"
                                              6⤵
                                                PID:2208
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 400
                                                  7⤵
                                                  • Program crash
                                                  PID:2120
                                              • C:\Users\Admin\Pictures\Adobe Films\INFdyWeCZdxZObhbTUTxiAdo.exe
                                                "C:\Users\Admin\Pictures\Adobe Films\INFdyWeCZdxZObhbTUTxiAdo.exe"
                                                6⤵
                                                  PID:4344
                                                • C:\Users\Admin\Pictures\Adobe Films\MEAA4p1r97nCLqnOjuIxrcki.exe
                                                  "C:\Users\Admin\Pictures\Adobe Films\MEAA4p1r97nCLqnOjuIxrcki.exe"
                                                  6⤵
                                                    PID:4840
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 672
                                                      7⤵
                                                      • Program crash
                                                      PID:3576
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 684
                                                      7⤵
                                                      • Program crash
                                                      PID:5624
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 648
                                                      7⤵
                                                      • Program crash
                                                      PID:5892
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 668
                                                      7⤵
                                                      • Program crash
                                                      PID:3148
                                                  • C:\Users\Admin\Pictures\Adobe Films\cLg5SfP8AquFer9H4wY0M_LY.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\cLg5SfP8AquFer9H4wY0M_LY.exe"
                                                    6⤵
                                                      PID:1264
                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                        7⤵
                                                          PID:5208
                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          7⤵
                                                            PID:2740
                                                        • C:\Users\Admin\Pictures\Adobe Films\4EZaxftHta_RFEA4myCwD0uY.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\4EZaxftHta_RFEA4myCwD0uY.exe"
                                                          6⤵
                                                            PID:1096
                                                          • C:\Users\Admin\Pictures\Adobe Films\VbAuk35mcwW237YlXGOkq6K4.exe
                                                            "C:\Users\Admin\Pictures\Adobe Films\VbAuk35mcwW237YlXGOkq6K4.exe"
                                                            6⤵
                                                              PID:3780
                                                            • C:\Users\Admin\Pictures\Adobe Films\pQBiwmaZ36vXPb1pX9YfKvHY.exe
                                                              "C:\Users\Admin\Pictures\Adobe Films\pQBiwmaZ36vXPb1pX9YfKvHY.exe"
                                                              6⤵
                                                                PID:4468
                                                              • C:\Users\Admin\Pictures\Adobe Films\XTn5tUJNThnFCkfnfJcZ35ST.exe
                                                                "C:\Users\Admin\Pictures\Adobe Films\XTn5tUJNThnFCkfnfJcZ35ST.exe"
                                                                6⤵
                                                                  PID:2424
                                                                  • C:\Windows\SysWOW64\mshta.exe
                                                                    "C:\Windows\System32\mshta.exe" vbsCrIPT: cLose ( CREatEObJECT ( "wSCripT.sHeLl" ).Run ( "C:\Windows\system32\cmd.exe /q /r TyPE ""C:\Users\Admin\Pictures\Adobe Films\XTn5tUJNThnFCkfnfJcZ35ST.exe"" > ..\ZCJQBxDe1bLl.exE && staRT ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe & If """" == """" for %e In ( ""C:\Users\Admin\Pictures\Adobe Films\XTn5tUJNThnFCkfnfJcZ35ST.exe"" ) do taskkill /iM ""%~Nxe"" -f ", 0 , TrUe ) )
                                                                    7⤵
                                                                      PID:5240
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /q /r TyPE "C:\Users\Admin\Pictures\Adobe Films\XTn5tUJNThnFCkfnfJcZ35ST.exe"> ..\ZCJQBxDe1bLl.exE && staRT ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe & If "" == "" for %e In ( "C:\Users\Admin\Pictures\Adobe Films\XTn5tUJNThnFCkfnfJcZ35ST.exe" ) do taskkill /iM "%~Nxe" -f
                                                                        8⤵
                                                                          PID:1500
                                                                          • C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE
                                                                            ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe
                                                                            9⤵
                                                                              PID:5968
                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                "C:\Windows\System32\mshta.exe" vbsCrIPT: cLose ( CREatEObJECT ( "wSCripT.sHeLl" ).Run ( "C:\Windows\system32\cmd.exe /q /r TyPE ""C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE"" > ..\ZCJQBxDe1bLl.exE && staRT ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe & If ""/pVxJDYWtOoH4fPZQYK~Ihe "" == """" for %e In ( ""C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE"" ) do taskkill /iM ""%~Nxe"" -f ", 0 , TrUe ) )
                                                                                10⤵
                                                                                  PID:3644
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /q /r TyPE "C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE"> ..\ZCJQBxDe1bLl.exE && staRT ..\zCjQBxDe1bLl.exE /pVxJDYWtOoH4fPZQYK~Ihe & If "/pVxJDYWtOoH4fPZQYK~Ihe " == "" for %e In ( "C:\Users\Admin\AppData\Local\Temp\ZCJQBxDe1bLl.exE" ) do taskkill /iM "%~Nxe" -f
                                                                                    11⤵
                                                                                      PID:5508
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  taskkill /iM "XTn5tUJNThnFCkfnfJcZ35ST.exe" -f
                                                                                  9⤵
                                                                                  • Kills process with taskkill
                                                                                  PID:1100
                                                                          • C:\Users\Admin\Pictures\Adobe Films\nIzHekt5Vbyd8gXBX7H_cOzM.exe
                                                                            "C:\Users\Admin\Pictures\Adobe Films\nIzHekt5Vbyd8gXBX7H_cOzM.exe"
                                                                            6⤵
                                                                              PID:4908
                                                                            • C:\Users\Admin\Pictures\Adobe Films\6lJC3uCPAhGou38QLiTXZqbR.exe
                                                                              "C:\Users\Admin\Pictures\Adobe Films\6lJC3uCPAhGou38QLiTXZqbR.exe"
                                                                              6⤵
                                                                                PID:4848
                                                                              • C:\Users\Admin\Pictures\Adobe Films\Ip6tK0xgMi2oNhi6oDqz_sCI.exe
                                                                                "C:\Users\Admin\Pictures\Adobe Films\Ip6tK0xgMi2oNhi6oDqz_sCI.exe"
                                                                                6⤵
                                                                                  PID:2296
                                                                                  • C:\Windows\system32\WerFault.exe
                                                                                    C:\Windows\system32\WerFault.exe -u -p 2296 -s 1988
                                                                                    7⤵
                                                                                    • Program crash
                                                                                    PID:5872
                                                                                • C:\Users\Admin\Pictures\Adobe Films\MbgAcLdW8UI82y6TXPhr1Hm1.exe
                                                                                  "C:\Users\Admin\Pictures\Adobe Films\MbgAcLdW8UI82y6TXPhr1Hm1.exe"
                                                                                  6⤵
                                                                                    PID:5028
                                                                                  • C:\Users\Admin\Pictures\Adobe Films\ReJrALRxoqE2IptwcUpyca7d.exe
                                                                                    "C:\Users\Admin\Pictures\Adobe Films\ReJrALRxoqE2IptwcUpyca7d.exe"
                                                                                    6⤵
                                                                                      PID:2164
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                                                                        7⤵
                                                                                          PID:1736
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                                                                          7⤵
                                                                                            PID:6092
                                                                                          • C:\Windows\System32\netsh.exe
                                                                                            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                            7⤵
                                                                                              PID:5216
                                                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                                                              schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                                                                              7⤵
                                                                                              • Creates scheduled task(s)
                                                                                              PID:5180
                                                                                            • C:\Windows\System\svchost.exe
                                                                                              "C:\Windows\System\svchost.exe" formal
                                                                                              7⤵
                                                                                                PID:2876
                                                                                              • C:\Windows\System32\netsh.exe
                                                                                                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                                                                                7⤵
                                                                                                  PID:5368
                                                                                              • C:\Users\Admin\Pictures\Adobe Films\FrD5sdLjLqj3n4WiM55ney2e.exe
                                                                                                "C:\Users\Admin\Pictures\Adobe Films\FrD5sdLjLqj3n4WiM55ney2e.exe"
                                                                                                6⤵
                                                                                                  PID:2644
                                                                                                  • C:\Users\Public\Videos\hgfdfds.exe
                                                                                                    "C:\Users\Public\Videos\hgfdfds.exe"
                                                                                                    7⤵
                                                                                                      PID:5980
                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\POO8hfWi9sr7zYOacu0zmk56.exe
                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\POO8hfWi9sr7zYOacu0zmk56.exe"
                                                                                                    6⤵
                                                                                                      PID:1968
                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\fONrWta0pj4QFzQAuli0SHhz.exe
                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\fONrWta0pj4QFzQAuli0SHhz.exe"
                                                                                                      6⤵
                                                                                                        PID:2932
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS7AB5.tmp\Install.exe
                                                                                                          .\Install.exe
                                                                                                          7⤵
                                                                                                            PID:5924
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSD018.tmp\Install.exe
                                                                                                              .\Install.exe /S /site_id "525403"
                                                                                                              8⤵
                                                                                                                PID:5344
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                                                  9⤵
                                                                                                                    PID:5588
                                                                                                                    • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                                      10⤵
                                                                                                                        PID:5696
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                                          11⤵
                                                                                                                            PID:3580
                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                                        9⤵
                                                                                                                          PID:4460
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                                            10⤵
                                                                                                                              PID:6128
                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                                                11⤵
                                                                                                                                  PID:644
                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                                                              9⤵
                                                                                                                                PID:5272
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                                                  10⤵
                                                                                                                                    PID:5772
                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                                                      11⤵
                                                                                                                                        PID:4484
                                                                                                                                      • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                                                        11⤵
                                                                                                                                          PID:5604
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "gnTtiEtDE" /SC once /ST 04:37:30 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                      9⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5132
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "gnTtiEtDE"
                                                                                                                                      9⤵
                                                                                                                                        PID:188
                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\2bHYlcqNQQeRjwzE02NmG57J.exe
                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\2bHYlcqNQQeRjwzE02NmG57J.exe"
                                                                                                                                  6⤵
                                                                                                                                    PID:1340
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\5uuYeKGOqmLcQKNQYuUY5QZT.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\5uuYeKGOqmLcQKNQYuUY5QZT.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:1568
                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\UxE0PlDNhTR5MmSA_V9W2kHI.exe
                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\UxE0PlDNhTR5MmSA_V9W2kHI.exe"
                                                                                                                                      6⤵
                                                                                                                                        PID:1016
                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\ZBWu0vUaiNqltZwYXfrmbFx_.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\ZBWu0vUaiNqltZwYXfrmbFx_.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:2856
                                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\_I4uCB0GTOuYCtdIbbea6Mab.exe
                                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\_I4uCB0GTOuYCtdIbbea6Mab.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:2088
                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\CWCFx2pZzV_Me71KrfEeiIza.exe
                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\CWCFx2pZzV_Me71KrfEeiIza.exe"
                                                                                                                                            6⤵
                                                                                                                                              PID:1888
                                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\fa9NV5kDsHsXUPWw6tiwsxYX.exe
                                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\fa9NV5kDsHsXUPWw6tiwsxYX.exe"
                                                                                                                                              6⤵
                                                                                                                                                PID:4916
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1IDu5Y02vpMCU\EasyCalc License Agreement.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\1IDu5Y02vpMCU\EasyCalc License Agreement.exe"
                                                                                                                                                  7⤵
                                                                                                                                                    PID:5632
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c Thu04c109370946a.exe
                                                                                                                                              4⤵
                                                                                                                                                PID:1744
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04c109370946a.exe
                                                                                                                                                  Thu04c109370946a.exe
                                                                                                                                                  5⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:1592
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-OHOAG.tmp\Thu04c109370946a.tmp
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-OHOAG.tmp\Thu04c109370946a.tmp" /SL5="$201DA,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04c109370946a.exe"
                                                                                                                                                    6⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    PID:896
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04c109370946a.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04c109370946a.exe" /SILENT
                                                                                                                                                      7⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1568
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-0OEJ0.tmp\Thu04c109370946a.tmp
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-0OEJ0.tmp\Thu04c109370946a.tmp" /SL5="$301DA,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04c109370946a.exe" /SILENT
                                                                                                                                                        8⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:5104
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-5UTO8.tmp\windllhost.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\is-5UTO8.tmp\windllhost.exe" 77
                                                                                                                                                          9⤵
                                                                                                                                                            PID:4856
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c Thu0442fc62eeb857aca.exe
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1528
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0442fc62eeb857aca.exe
                                                                                                                                                      Thu0442fc62eeb857aca.exe
                                                                                                                                                      5⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1144
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c Thu0483c35fbf3ec8d.exe
                                                                                                                                                    4⤵
                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                    PID:1304
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c Thu04eef50b2b35a1.exe
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1188
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04eef50b2b35a1.exe
                                                                                                                                                        Thu04eef50b2b35a1.exe
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                        PID:1868
                                                                                                                                                        • C:\Windows\system32\WerFault.exe
                                                                                                                                                          C:\Windows\system32\WerFault.exe -u -p 1868 -s 2044
                                                                                                                                                          6⤵
                                                                                                                                                          • Program crash
                                                                                                                                                          PID:3752
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c Thu0431d38e2544.exe
                                                                                                                                                      4⤵
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      PID:1096
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0431d38e2544.exe
                                                                                                                                                        Thu0431d38e2544.exe
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:2588
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0431d38e2544.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0431d38e2544.exe" -u
                                                                                                                                                          6⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5116
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c Thu04fb797f99fe7dae8.exe
                                                                                                                                                      4⤵
                                                                                                                                                        PID:1992
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04fb797f99fe7dae8.exe
                                                                                                                                                          Thu04fb797f99fe7dae8.exe
                                                                                                                                                          5⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Modifies registry class
                                                                                                                                                          PID:2244
                                                                                                                                                          • C:\Windows\SysWOW64\control.exe
                                                                                                                                                            "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\c33Ko.Cpl",
                                                                                                                                                            6⤵
                                                                                                                                                              PID:1676
                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\c33Ko.Cpl",
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:3592
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c Thu04115bb33998ce.exe
                                                                                                                                                            4⤵
                                                                                                                                                              PID:2552
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04115bb33998ce.exe
                                                                                                                                                                Thu04115bb33998ce.exe
                                                                                                                                                                5⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                PID:4312
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c Thu0460219468fd5c220.exe
                                                                                                                                                              4⤵
                                                                                                                                                                PID:2628
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0460219468fd5c220.exe
                                                                                                                                                                  Thu0460219468fd5c220.exe
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                  PID:2128
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0460219468fd5c220.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0460219468fd5c220.exe
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:1268
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c Thu046f48ffab4707f.exe
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:3064
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu046f48ffab4707f.exe
                                                                                                                                                                      Thu046f48ffab4707f.exe
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:4824
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:1184
                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                            taskkill /f /im chrome.exe
                                                                                                                                                                            7⤵
                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                            PID:2792
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c Thu04865988bc.exe
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:2192
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04865988bc.exe
                                                                                                                                                                          Thu04865988bc.exe
                                                                                                                                                                          5⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          PID:4872
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im Thu04865988bc.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu04865988bc.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:1120
                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                taskkill /im Thu04865988bc.exe /f
                                                                                                                                                                                7⤵
                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                PID:2448
                                                                                                                                                                              • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                                                                timeout /t 6
                                                                                                                                                                                7⤵
                                                                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                                                                PID:5824
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8D1D4376\Thu0483c35fbf3ec8d.exe
                                                                                                                                                                    Thu0483c35fbf3ec8d.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:1716
                                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                                    PID:736
                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2132
                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:3088

                                                                                                                                                                      Network

                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                            Replay Monitor

                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                            Downloads

                                                                                                                                                                            • memory/320-349-0x0000020A1DA60000-0x0000020A1DA62000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/320-346-0x0000020A1DA60000-0x0000020A1DA62000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/792-303-0x0000000007FF0000-0x0000000008056000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              408KB

                                                                                                                                                                            • memory/792-271-0x0000000007740000-0x0000000007D68000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              6.2MB

                                                                                                                                                                            • memory/792-294-0x00000000076B0000-0x00000000076D2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              136KB

                                                                                                                                                                            • memory/792-252-0x0000000004F80000-0x0000000004FB6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              216KB

                                                                                                                                                                            • memory/792-229-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/792-306-0x0000000008060000-0x00000000083B0000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              3.3MB

                                                                                                                                                                            • memory/792-246-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/792-257-0x0000000004BD2000-0x0000000004BD3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/792-302-0x0000000007DE0000-0x0000000007E46000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              408KB

                                                                                                                                                                            • memory/792-374-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/792-230-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/824-365-0x000001E7D2110000-0x000001E7D2112000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/824-366-0x000001E7D2110000-0x000001E7D2112000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/896-244-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/1032-256-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              340KB

                                                                                                                                                                            • memory/1080-362-0x000002239ACB0000-0x000002239ACB2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1080-364-0x000002239ACB0000-0x000002239ACB2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1096-414-0x0000000000EE0000-0x00000000010A8000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.8MB

                                                                                                                                                                            • memory/1244-383-0x0000013A954F0000-0x0000013A954F2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1244-382-0x0000013A954F0000-0x0000013A954F2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1268-321-0x0000000005670000-0x0000000005C76000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              6.0MB

                                                                                                                                                                            • memory/1268-318-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              128KB

                                                                                                                                                                            • memory/1268-315-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              128KB

                                                                                                                                                                            • memory/1268-312-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              128KB

                                                                                                                                                                            • memory/1296-376-0x000001A964D70000-0x000001A964D72000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1296-379-0x000001A964D70000-0x000001A964D72000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1432-370-0x000001D110DF0000-0x000001D110DF2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1432-368-0x000001D110DF0000-0x000001D110DF2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1568-249-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              816KB

                                                                                                                                                                            • memory/1592-228-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              816KB

                                                                                                                                                                            • memory/1716-220-0x000000001B2B0000-0x000000001B2B2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1716-194-0x00000000005E0000-0x00000000005E8000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              32KB

                                                                                                                                                                            • memory/1716-188-0x00000000005E0000-0x00000000005E8000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              32KB

                                                                                                                                                                            • memory/1816-214-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              320KB

                                                                                                                                                                            • memory/1816-224-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              320KB

                                                                                                                                                                            • memory/1828-371-0x00000256739E0000-0x00000256739E2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1828-372-0x00000256739E0000-0x00000256739E2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1868-240-0x0000000000BB0000-0x0000000000BB6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              24KB

                                                                                                                                                                            • memory/1868-198-0x0000000000440000-0x000000000048A000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              296KB

                                                                                                                                                                            • memory/1868-234-0x000000001B110000-0x000000001B112000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/1868-195-0x0000000000440000-0x000000000048A000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              296KB

                                                                                                                                                                            • memory/1868-221-0x0000000000970000-0x0000000000976000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              24KB

                                                                                                                                                                            • memory/1868-231-0x0000000000980000-0x00000000009B6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              216KB

                                                                                                                                                                            • memory/2024-279-0x0000000000740000-0x0000000000756000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              88KB

                                                                                                                                                                            • memory/2128-275-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2128-237-0x0000000000260000-0x00000000002EC000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              560KB

                                                                                                                                                                            • memory/2128-235-0x0000000000260000-0x00000000002EC000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              560KB

                                                                                                                                                                            • memory/2128-276-0x0000000004A30000-0x0000000004A31000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2128-309-0x0000000005360000-0x000000000585E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              5.0MB

                                                                                                                                                                            • memory/2128-282-0x0000000004AD0000-0x0000000004B46000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              472KB

                                                                                                                                                                            • memory/2128-286-0x0000000004AB0000-0x0000000004ACE000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              120KB

                                                                                                                                                                            • memory/2132-324-0x00000000049A0000-0x00000000049FD000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              372KB

                                                                                                                                                                            • memory/2132-323-0x0000000004894000-0x0000000004995000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.0MB

                                                                                                                                                                            • memory/2244-208-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2244-209-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2268-320-0x0000000003DD0000-0x0000000003F1E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.3MB

                                                                                                                                                                            • memory/2356-354-0x000001A86B3E0000-0x000001A86B3E2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2356-353-0x000001A86B3E0000-0x000001A86B3E2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2372-359-0x00000180AF1E0000-0x00000180AF1E2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2372-360-0x00000180AF1E0000-0x00000180AF1E2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2568-337-0x000001BCE19D0000-0x000001BCE19D2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2568-339-0x000001BCE19D0000-0x000001BCE19D2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2656-385-0x000001BA2BF50000-0x000001BA2BF52000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2656-392-0x000001BA2BF50000-0x000001BA2BF52000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2676-396-0x0000025F2F6E0000-0x0000025F2F6E2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2676-397-0x0000025F2F6E0000-0x0000025F2F6E2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/2700-236-0x0000000000C50000-0x0000000000CDC000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              560KB

                                                                                                                                                                            • memory/2700-283-0x0000000003050000-0x000000000306E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              120KB

                                                                                                                                                                            • memory/2700-239-0x0000000000C50000-0x0000000000CDC000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              560KB

                                                                                                                                                                            • memory/2700-277-0x0000000005680000-0x0000000005681000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2700-278-0x0000000001470000-0x0000000001471000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/2700-308-0x0000000005D90000-0x000000000628E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              5.0MB

                                                                                                                                                                            • memory/2700-281-0x0000000005560000-0x00000000055D6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              472KB

                                                                                                                                                                            • memory/3088-348-0x0000024051DF0000-0x0000024051DF2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/3088-345-0x0000024051DF0000-0x0000024051DF2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/4312-265-0x0000000000400000-0x000000000083F000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4.2MB

                                                                                                                                                                            • memory/4312-261-0x0000000000950000-0x0000000000959000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              36KB

                                                                                                                                                                            • memory/4312-260-0x0000000000030000-0x0000000000038000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              32KB

                                                                                                                                                                            • memory/4460-288-0x0000000000400000-0x000000000047C000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              496KB

                                                                                                                                                                            • memory/4612-134-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              572KB

                                                                                                                                                                            • memory/4612-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.5MB

                                                                                                                                                                            • memory/4612-150-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                            • memory/4612-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              572KB

                                                                                                                                                                            • memory/4612-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              572KB

                                                                                                                                                                            • memory/4612-147-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                            • memory/4612-153-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                            • memory/4612-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.5MB

                                                                                                                                                                            • memory/4612-156-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              100KB

                                                                                                                                                                            • memory/4612-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.5MB

                                                                                                                                                                            • memory/4612-139-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              152KB

                                                                                                                                                                            • memory/4612-138-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              1.5MB

                                                                                                                                                                            • memory/4860-333-0x0000027EEDA00000-0x0000027EEDA02000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/4860-403-0x0000027EEDAD0000-0x0000027EEDAD4000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16KB

                                                                                                                                                                            • memory/4860-334-0x0000027EEDA00000-0x0000027EEDA02000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                            • memory/4860-406-0x0000027EEDAC0000-0x0000027EEDAC1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/4872-266-0x0000000000400000-0x00000000008B2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4.7MB

                                                                                                                                                                            • memory/4872-264-0x0000000000DA0000-0x0000000000E75000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              852KB

                                                                                                                                                                            • memory/4872-263-0x0000000000D20000-0x0000000000D9C000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              496KB

                                                                                                                                                                            • memory/4972-295-0x0000000007880000-0x00000000078A2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              136KB

                                                                                                                                                                            • memory/4972-301-0x00000000078B0000-0x0000000007916000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              408KB

                                                                                                                                                                            • memory/4972-225-0x0000000003330000-0x0000000003331000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/4972-248-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/4972-253-0x00000000050F0000-0x0000000005126000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              216KB

                                                                                                                                                                            • memory/4972-258-0x00000000050A2000-0x00000000050A3000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/4972-307-0x0000000008140000-0x0000000008490000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              3.3MB

                                                                                                                                                                            • memory/4972-373-0x0000000003330000-0x0000000003331000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/4972-227-0x0000000003330000-0x0000000003331000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/4972-304-0x0000000008070000-0x00000000080D6000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              408KB

                                                                                                                                                                            • memory/4972-270-0x0000000007940000-0x0000000007F68000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              6.2MB

                                                                                                                                                                            • memory/5056-190-0x0000000000140000-0x0000000000141000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/5056-193-0x0000000000140000-0x0000000000141000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                            • memory/5104-267-0x0000000000690000-0x000000000073E000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              696KB

                                                                                                                                                                            • memory/5108-317-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              128KB

                                                                                                                                                                            • memory/5108-311-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              128KB

                                                                                                                                                                            • memory/5108-316-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              128KB

                                                                                                                                                                            • memory/5108-322-0x0000000005900000-0x0000000005F06000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              6.0MB