Analysis

  • max time kernel
    150s
  • max time network
    168s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    23/12/2021, 13:28

General

  • Target

    926d5da2e499201330d8a2e48ce142e75dac0dcd478409fc25adb7127dc257b1.exe

  • Size

    9.8MB

  • MD5

    4b059aee403e22a0d3f1fb16ca642d13

  • SHA1

    919dd86c5d8cdb7918048e6a5891e1388232b05d

  • SHA256

    926d5da2e499201330d8a2e48ce142e75dac0dcd478409fc25adb7127dc257b1

  • SHA512

    f3ec24e81e6a4689dd6f9ae82fd8fa9a0b4c9485d81e7d0986882d4ff04896a05af996aa6d41531beb179215f3e34147229e865a72c3f22a4fc368ca378f1cd4

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.2

Botnet

915

C2

https://mstdn.social/@kipriauk9

https://qoto.org/@kipriauk8

Attributes
  • profile_id

    915

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

8fc55a7ea41b0c5db2ca3c881e20966100c28a40

Attributes
  • url4cnc

    http://194.180.174.53/jredmankun

    http://91.219.236.18/jredmankun

    http://194.180.174.41/jredmankun

    http://91.219.236.148/jredmankun

    https://t.me/jredmankun

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

media22ns

C2

65.108.69.168:13293

Extracted

Family

redline

Botnet

v3user1

C2

159.69.246.184:13127

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 8 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 38 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 3 IoCs
  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 24 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s BITS
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    PID:4540
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:3896
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2616
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2444
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
          PID:2420
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2236
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2216
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1912
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1476
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1348
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1272
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1140
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                        • Drops file in System32 directory
                        PID:1076
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:524
                        • C:\Users\Admin\AppData\Local\Temp\926d5da2e499201330d8a2e48ce142e75dac0dcd478409fc25adb7127dc257b1.exe
                          "C:\Users\Admin\AppData\Local\Temp\926d5da2e499201330d8a2e48ce142e75dac0dcd478409fc25adb7127dc257b1.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3344
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4048
                            • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:4304
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                4⤵
                                  PID:2792
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                                    5⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2464
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3832
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                    5⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2468
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Wed1773e5c68964.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:3912
                                  • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed1773e5c68964.exe
                                    Wed1773e5c68964.exe
                                    5⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: MapViewOfSection
                                    PID:1836
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c Wed171e1acc48fd84.exe
                                  4⤵
                                    PID:4508
                                    • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed171e1acc48fd84.exe
                                      Wed171e1acc48fd84.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Modifies registry class
                                      PID:2248
                                      • C:\Windows\SysWOW64\control.exe
                                        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\VRH1SDG.CPl",
                                        6⤵
                                          PID:4704
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\VRH1SDG.CPl",
                                            7⤵
                                            • Loads dropped DLL
                                            PID:4024
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Wed174fd2d1d7.exe
                                      4⤵
                                        PID:3096
                                        • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed174fd2d1d7.exe
                                          Wed174fd2d1d7.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Checks processor information in registry
                                          PID:1920
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c taskkill /im Wed174fd2d1d7.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed174fd2d1d7.exe" & del C:\ProgramData\*.dll & exit
                                            6⤵
                                              PID:3924
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /im Wed174fd2d1d7.exe /f
                                                7⤵
                                                • Kills process with taskkill
                                                PID:1924
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout /t 6
                                                7⤵
                                                • Delays execution with timeout.exe
                                                PID:1564
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Wed17490390f788.exe
                                          4⤵
                                            PID:532
                                            • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17490390f788.exe
                                              Wed17490390f788.exe
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1864
                                              • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17490390f788.exe
                                                C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17490390f788.exe
                                                6⤵
                                                • Executes dropped EXE
                                                PID:1120
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Wed17bfb56d5816913eb.exe
                                            4⤵
                                              PID:664
                                              • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17bfb56d5816913eb.exe
                                                Wed17bfb56d5816913eb.exe
                                                5⤵
                                                • Executes dropped EXE
                                                PID:2256
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Wed17e564879ff.exe
                                              4⤵
                                                PID:936
                                                • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17e564879ff.exe
                                                  Wed17e564879ff.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1856
                                                  • C:\Users\Admin\AppData\Local\1da78dc3-ddbd-4a91-b082-95f2e777dfe5.exe
                                                    "C:\Users\Admin\AppData\Local\1da78dc3-ddbd-4a91-b082-95f2e777dfe5.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:4864
                                                  • C:\Users\Admin\AppData\Local\2bf8f134-5834-494c-966a-aa7ab114033d.exe
                                                    "C:\Users\Admin\AppData\Local\2bf8f134-5834-494c-966a-aa7ab114033d.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:2628
                                                  • C:\Users\Admin\AppData\Local\beae4bc9-6067-42d5-9626-267e218f4def.exe
                                                    "C:\Users\Admin\AppData\Local\beae4bc9-6067-42d5-9626-267e218f4def.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:4772
                                                    • C:\Users\Admin\AppData\Roaming\5061851.exe
                                                      "C:\Users\Admin\AppData\Roaming\5061851.exe"
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Modifies registry class
                                                      PID:1184
                                                      • C:\Windows\SysWOW64\control.exe
                                                        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\ZO8YMp.CPL",
                                                        8⤵
                                                          PID:4956
                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                            "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\ZO8YMp.CPL",
                                                            9⤵
                                                              PID:1320
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c Wed17c3d6ceb0e.exe
                                                    4⤵
                                                      PID:432
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17c3d6ceb0e.exe
                                                        Wed17c3d6ceb0e.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:2148
                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:4140
                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                          6⤵
                                                          • Executes dropped EXE
                                                          PID:4436
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c Wed177d7e0b80e32.exe
                                                      4⤵
                                                        PID:1028
                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed177d7e0b80e32.exe
                                                          Wed177d7e0b80e32.exe
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:2052
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c Wed17447053894b5.exe
                                                        4⤵
                                                          PID:1248
                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17447053894b5.exe
                                                            Wed17447053894b5.exe
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:2232
                                                            • C:\Users\Admin\AppData\Local\Temp\is-2L5EE.tmp\Wed17447053894b5.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\is-2L5EE.tmp\Wed17447053894b5.tmp" /SL5="$70050,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17447053894b5.exe"
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              PID:1108
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17447053894b5.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17447053894b5.exe" /SILENT
                                                                7⤵
                                                                • Executes dropped EXE
                                                                PID:668
                                                                • C:\Users\Admin\AppData\Local\Temp\is-0IU25.tmp\Wed17447053894b5.tmp
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-0IU25.tmp\Wed17447053894b5.tmp" /SL5="$2020A,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17447053894b5.exe" /SILENT
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:4276
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-QEDTO.tmp\windllhost.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-QEDTO.tmp\windllhost.exe" 77
                                                                    9⤵
                                                                    • Executes dropped EXE
                                                                    PID:4948
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c Wed177522e89359.exe
                                                          4⤵
                                                            PID:1312
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed177522e89359.exe
                                                              Wed177522e89359.exe
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Checks BIOS information in registry
                                                              • Checks whether UAC is enabled
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3256
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Wed177feadfac6e2.exe
                                                            4⤵
                                                              PID:1428
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed177feadfac6e2.exe
                                                                Wed177feadfac6e2.exe
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:2336
                                                                • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:2640
                                                                  • C:\Users\Admin\AppData\Local\Temp\myamrnewfile.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\myamrnewfile.exe"
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:1116
                                                                  • C:\Users\Admin\AppData\Local\Temp\RobCleanerInstll31827.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\RobCleanerInstll31827.exe"
                                                                    7⤵
                                                                    • Executes dropped EXE
                                                                    PID:1712
                                                                    • C:\Users\Admin\AppData\Local\fa854a4e-098f-4b2e-a6c2-1b3862b3a87e.exe
                                                                      "C:\Users\Admin\AppData\Local\fa854a4e-098f-4b2e-a6c2-1b3862b3a87e.exe"
                                                                      8⤵
                                                                      • Executes dropped EXE
                                                                      PID:1520
                                                                    • C:\Users\Admin\AppData\Local\28eeeca2-55dc-45b2-94d6-094892f2094b.exe
                                                                      "C:\Users\Admin\AppData\Local\28eeeca2-55dc-45b2-94d6-094892f2094b.exe"
                                                                      8⤵
                                                                        PID:1944
                                                                      • C:\Users\Admin\AppData\Local\82627992-9197-40f5-9261-1104c6fbb7de.exe
                                                                        "C:\Users\Admin\AppData\Local\82627992-9197-40f5-9261-1104c6fbb7de.exe"
                                                                        8⤵
                                                                          PID:2052
                                                                          • C:\Users\Admin\AppData\Roaming\1920195.exe
                                                                            "C:\Users\Admin\AppData\Roaming\1920195.exe"
                                                                            9⤵
                                                                              PID:4632
                                                                              • C:\Windows\SysWOW64\control.exe
                                                                                "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\ZO8YMp.CPL",
                                                                                10⤵
                                                                                  PID:1264
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\ZO8YMp.CPL",
                                                                                    11⤵
                                                                                      PID:3180
                                                                            • C:\Users\Admin\AppData\Local\Temp\DisgruntleMezzanines_2021-12-22_21-08.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\DisgruntleMezzanines_2021-12-22_21-08.exe"
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              PID:2596
                                                                            • C:\Users\Admin\AppData\Local\Temp\inst.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\inst.exe"
                                                                              7⤵
                                                                              • Executes dropped EXE
                                                                              PID:5020
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c Wed170f684959b54cd.exe
                                                                        4⤵
                                                                          PID:1608
                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed170f684959b54cd.exe
                                                                            Wed170f684959b54cd.exe
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Modifies registry class
                                                                            PID:3828
                                                                            • C:\Windows\SysWOW64\control.exe
                                                                              "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\VRH1SDG.CPl",
                                                                              6⤵
                                                                                PID:1044
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\VRH1SDG.CPl",
                                                                                  7⤵
                                                                                  • Loads dropped DLL
                                                                                  PID:2196
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c Wed17ba81947100.exe /mixtwo
                                                                            4⤵
                                                                              PID:1540
                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17ba81947100.exe
                                                                                Wed17ba81947100.exe /mixtwo
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetThreadContext
                                                                                PID:2404
                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17ba81947100.exe
                                                                                  Wed17ba81947100.exe /mixtwo
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1964
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "Wed17ba81947100.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17ba81947100.exe" & exit
                                                                                    7⤵
                                                                                      PID:1996
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        taskkill /im "Wed17ba81947100.exe" /f
                                                                                        8⤵
                                                                                        • Kills process with taskkill
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:732
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c Wed17a7fa0741c6202.exe
                                                                                4⤵
                                                                                  PID:1176
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17a7fa0741c6202.exe
                                                                                    Wed17a7fa0741c6202.exe
                                                                                    5⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1512
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17a7fa0741c6202.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed17a7fa0741c6202.exe" -u
                                                                                      6⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4780
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c Wed176510fc794f72.exe
                                                                                  4⤵
                                                                                    PID:4236
                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed176510fc794f72.exe
                                                                                      Wed176510fc794f72.exe
                                                                                      5⤵
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetThreadContext
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:2104
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed176510fc794f72.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed176510fc794f72.exe
                                                                                        6⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4560
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c Wed179170b19a.exe
                                                                                    4⤵
                                                                                      PID:2020
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0DF8F306\Wed179170b19a.exe
                                                                                        Wed179170b19a.exe
                                                                                        5⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:2432
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          cmd.exe /c taskkill /f /im chrome.exe
                                                                                          6⤵
                                                                                            PID:4048
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              taskkill /f /im chrome.exe
                                                                                              7⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:3908
                                                                                • C:\Windows\system32\rundll32.exe
                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                  1⤵
                                                                                  • Process spawned unexpected child process
                                                                                  PID:1680
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                    2⤵
                                                                                    • Loads dropped DLL
                                                                                    • Modifies registry class
                                                                                    PID:1956

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v6

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      • memory/524-382-0x0000024D6ADE0000-0x0000024D6ADE2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/524-383-0x0000024D6ADE0000-0x0000024D6ADE2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/668-310-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                        Filesize

                                                                                        816KB

                                                                                      • memory/1076-406-0x0000017B3D9B0000-0x0000017B3D9B2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1076-409-0x0000017B3D9B0000-0x0000017B3D9B2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1108-277-0x0000000000690000-0x000000000073E000-memory.dmp

                                                                                        Filesize

                                                                                        696KB

                                                                                      • memory/1120-364-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/1140-399-0x000002416E300000-0x000002416E302000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1140-395-0x000002416E300000-0x000002416E302000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1476-418-0x00000116881D0000-0x00000116881D2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1476-420-0x00000116881D0000-0x00000116881D2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1836-264-0x0000000000400000-0x00000000004C9000-memory.dmp

                                                                                        Filesize

                                                                                        804KB

                                                                                      • memory/1836-261-0x00000000001D0000-0x00000000001D9000-memory.dmp

                                                                                        Filesize

                                                                                        36KB

                                                                                      • memory/1856-260-0x0000000001370000-0x00000000013A6000-memory.dmp

                                                                                        Filesize

                                                                                        216KB

                                                                                      • memory/1856-251-0x000000001B9C0000-0x000000001B9C2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1856-213-0x0000000000C20000-0x0000000000C6A000-memory.dmp

                                                                                        Filesize

                                                                                        296KB

                                                                                      • memory/1856-218-0x0000000000C20000-0x0000000000C6A000-memory.dmp

                                                                                        Filesize

                                                                                        296KB

                                                                                      • memory/1856-276-0x00000000013A0000-0x00000000013A6000-memory.dmp

                                                                                        Filesize

                                                                                        24KB

                                                                                      • memory/1856-237-0x0000000001360000-0x0000000001366000-memory.dmp

                                                                                        Filesize

                                                                                        24KB

                                                                                      • memory/1864-285-0x0000000005850000-0x00000000058C6000-memory.dmp

                                                                                        Filesize

                                                                                        472KB

                                                                                      • memory/1864-293-0x0000000005810000-0x000000000582E000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                      • memory/1864-298-0x00000000031A0000-0x00000000031A1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1864-235-0x0000000000FC0000-0x000000000104C000-memory.dmp

                                                                                        Filesize

                                                                                        560KB

                                                                                      • memory/1864-324-0x0000000006240000-0x000000000673E000-memory.dmp

                                                                                        Filesize

                                                                                        5.0MB

                                                                                      • memory/1864-296-0x00000000059B0000-0x00000000059B1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/1864-229-0x0000000000FC0000-0x000000000104C000-memory.dmp

                                                                                        Filesize

                                                                                        560KB

                                                                                      • memory/1912-422-0x0000021DD6DE0000-0x0000021DD6DE2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1912-421-0x0000021DD6DE0000-0x0000021DD6DE2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/1920-265-0x0000000000400000-0x0000000000535000-memory.dmp

                                                                                        Filesize

                                                                                        1.2MB

                                                                                      • memory/1920-258-0x00000000021E0000-0x00000000022B5000-memory.dmp

                                                                                        Filesize

                                                                                        852KB

                                                                                      • memory/1920-257-0x0000000000826000-0x00000000008A2000-memory.dmp

                                                                                        Filesize

                                                                                        496KB

                                                                                      • memory/1964-244-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                        Filesize

                                                                                        320KB

                                                                                      • memory/1964-212-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                        Filesize

                                                                                        320KB

                                                                                      • memory/2104-295-0x0000000000E60000-0x0000000000E61000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2104-327-0x0000000005550000-0x0000000005A4E000-memory.dmp

                                                                                        Filesize

                                                                                        5.0MB

                                                                                      • memory/2104-290-0x0000000004C90000-0x0000000004CAE000-memory.dmp

                                                                                        Filesize

                                                                                        120KB

                                                                                      • memory/2104-232-0x0000000000440000-0x00000000004CC000-memory.dmp

                                                                                        Filesize

                                                                                        560KB

                                                                                      • memory/2104-284-0x0000000004D20000-0x0000000004D96000-memory.dmp

                                                                                        Filesize

                                                                                        472KB

                                                                                      • memory/2104-236-0x0000000000440000-0x00000000004CC000-memory.dmp

                                                                                        Filesize

                                                                                        560KB

                                                                                      • memory/2104-294-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2216-385-0x000001E9AAEC0000-0x000001E9AAEC2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/2216-384-0x000001E9AAEC0000-0x000001E9AAEC2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/2232-245-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                        Filesize

                                                                                        816KB

                                                                                      • memory/2236-391-0x000001E088AB0000-0x000001E088AB2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/2236-389-0x000001E088AB0000-0x000001E088AB2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/2248-215-0x0000000000270000-0x0000000000271000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2248-220-0x0000000000270000-0x0000000000271000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2336-211-0x00000000006E0000-0x00000000006E8000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                      • memory/2336-216-0x00000000006E0000-0x00000000006E8000-memory.dmp

                                                                                        Filesize

                                                                                        32KB

                                                                                      • memory/2336-234-0x000000001B310000-0x000000001B312000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/2464-239-0x0000000004720000-0x0000000004721000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2464-311-0x0000000007600000-0x0000000007666000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/2464-223-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2464-268-0x0000000004722000-0x0000000004723000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2464-300-0x0000000006C10000-0x0000000006C32000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      • memory/2464-307-0x0000000007710000-0x0000000007776000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/2464-322-0x0000000007780000-0x0000000007AD0000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/2464-238-0x0000000004290000-0x00000000042C6000-memory.dmp

                                                                                        Filesize

                                                                                        216KB

                                                                                      • memory/2464-225-0x0000000000820000-0x0000000000821000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2464-281-0x0000000006E30000-0x0000000007458000-memory.dmp

                                                                                        Filesize

                                                                                        6.2MB

                                                                                      • memory/2468-267-0x0000000004B32000-0x0000000004B33000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2468-303-0x0000000007CC0000-0x0000000007D26000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/2468-282-0x0000000007590000-0x0000000007BB8000-memory.dmp

                                                                                        Filesize

                                                                                        6.2MB

                                                                                      • memory/2468-231-0x0000000003200000-0x0000000003201000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2468-305-0x0000000007D50000-0x0000000007DB6000-memory.dmp

                                                                                        Filesize

                                                                                        408KB

                                                                                      • memory/2468-240-0x0000000004B40000-0x0000000004B76000-memory.dmp

                                                                                        Filesize

                                                                                        216KB

                                                                                      • memory/2468-242-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2468-325-0x0000000007FA0000-0x00000000082F0000-memory.dmp

                                                                                        Filesize

                                                                                        3.3MB

                                                                                      • memory/2468-227-0x0000000003200000-0x0000000003201000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2468-301-0x0000000007BC0000-0x0000000007BE2000-memory.dmp

                                                                                        Filesize

                                                                                        136KB

                                                                                      • memory/2612-266-0x0000000000D20000-0x0000000000D36000-memory.dmp

                                                                                        Filesize

                                                                                        88KB

                                                                                      • memory/2616-379-0x0000017649200000-0x0000017649202000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/2616-376-0x0000017649200000-0x0000017649202000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/2628-343-0x000000006FCB0000-0x000000006FD30000-memory.dmp

                                                                                        Filesize

                                                                                        512KB

                                                                                      • memory/2628-336-0x00000000762F0000-0x00000000764B2000-memory.dmp

                                                                                        Filesize

                                                                                        1.8MB

                                                                                      • memory/2628-334-0x00000000001B0000-0x00000000001B1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/2628-394-0x0000000076A40000-0x0000000076FC4000-memory.dmp

                                                                                        Filesize

                                                                                        5.5MB

                                                                                      • memory/2628-338-0x0000000075630000-0x0000000075721000-memory.dmp

                                                                                        Filesize

                                                                                        964KB

                                                                                      • memory/2628-333-0x0000000000CD0000-0x0000000000D49000-memory.dmp

                                                                                        Filesize

                                                                                        484KB

                                                                                      • memory/2628-335-0x0000000000500000-0x00000000005AE000-memory.dmp

                                                                                        Filesize

                                                                                        696KB

                                                                                      • memory/2640-329-0x0000000000100000-0x0000000000250000-memory.dmp

                                                                                        Filesize

                                                                                        1.3MB

                                                                                      • memory/2640-323-0x0000000000100000-0x0000000000250000-memory.dmp

                                                                                        Filesize

                                                                                        1.3MB

                                                                                      • memory/3256-278-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-228-0x0000000000A90000-0x0000000000AD5000-memory.dmp

                                                                                        Filesize

                                                                                        276KB

                                                                                      • memory/3256-283-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-270-0x0000000075630000-0x0000000075721000-memory.dmp

                                                                                        Filesize

                                                                                        964KB

                                                                                      • memory/3256-291-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-247-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-241-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-287-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-297-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-222-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-308-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-279-0x0000000077000000-0x000000007718E000-memory.dmp

                                                                                        Filesize

                                                                                        1.6MB

                                                                                      • memory/3256-233-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-262-0x00000000762F0000-0x00000000764B2000-memory.dmp

                                                                                        Filesize

                                                                                        1.8MB

                                                                                      • memory/3256-280-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-249-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-248-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3256-250-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/3256-224-0x0000000000B60000-0x000000000111D000-memory.dmp

                                                                                        Filesize

                                                                                        5.7MB

                                                                                      • memory/3828-219-0x0000000002F50000-0x0000000002F51000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/3828-214-0x0000000002F50000-0x0000000002F51000-memory.dmp

                                                                                        Filesize

                                                                                        4KB

                                                                                      • memory/3896-381-0x00000165DF0A0000-0x00000165DF0A2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/3896-380-0x00000165DF0A0000-0x00000165DF0A2000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/4140-263-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                        Filesize

                                                                                        340KB

                                                                                      • memory/4304-160-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/4304-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/4304-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                        Filesize

                                                                                        572KB

                                                                                      • memory/4304-161-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/4304-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                        Filesize

                                                                                        572KB

                                                                                      • memory/4304-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                        Filesize

                                                                                        572KB

                                                                                      • memory/4304-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/4304-157-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/4304-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/4304-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                        Filesize

                                                                                        1.5MB

                                                                                      • memory/4304-138-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                        Filesize

                                                                                        152KB

                                                                                      • memory/4304-154-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                        Filesize

                                                                                        100KB

                                                                                      • memory/4436-289-0x0000000000400000-0x000000000047C000-memory.dmp

                                                                                        Filesize

                                                                                        496KB

                                                                                      • memory/4540-366-0x000001D9F0050000-0x000001D9F0052000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/4540-371-0x000001D9F0050000-0x000001D9F0052000-memory.dmp

                                                                                        Filesize

                                                                                        8KB

                                                                                      • memory/4560-365-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                        Filesize

                                                                                        128KB

                                                                                      • memory/4864-331-0x0000000000600000-0x000000000064C000-memory.dmp

                                                                                        Filesize

                                                                                        304KB

                                                                                      • memory/4864-332-0x0000000000600000-0x000000000064C000-memory.dmp

                                                                                        Filesize

                                                                                        304KB