Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    26/12/2021, 06:26

General

  • Target

    a15fcb15ff8d0824099fe99986c3425f.exe

  • Size

    6.3MB

  • MD5

    a15fcb15ff8d0824099fe99986c3425f

  • SHA1

    b041d309bcb43b100d7f93a99ad43e8725413ceb

  • SHA256

    a8608c25f43dcab1c8501cb89b796d75b94a0abd260d3cee39a7e56e889326d6

  • SHA512

    1ed23bdf6a454d8dc36abdbdc76eff61c79e0b25970cf98cea71e4873bb417594870ff5500cb0595abb6c3dbb9b451ad92e6e05ba1eedbe9f03f5edf36f73f45

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.2

Botnet

915

C2

https://mstdn.social/@kipriauk9

https://qoto.org/@kipriauk8

Attributes
  • profile_id

    915

Extracted

Family

redline

Botnet

media22ns

C2

65.108.69.168:13293

Extracted

Family

redline

Botnet

userv1

C2

159.69.246.184:13127

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE GCleaner Downloader Activity M5

    suricata: ET MALWARE GCleaner Downloader Activity M5

  • suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

    suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01

  • suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

    suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin

  • suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

    suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 5 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Loads dropped DLL 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a15fcb15ff8d0824099fe99986c3425f.exe
    "C:\Users\Admin\AppData\Local\Temp\a15fcb15ff8d0824099fe99986c3425f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:692
    • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3700
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4076
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
            PID:1544
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3064
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1684
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu1185475076e48cb16.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4036
          • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu1185475076e48cb16.exe
            Thu1185475076e48cb16.exe
            4⤵
            • Executes dropped EXE
            PID:2752
            • C:\Windows\SysWOW64\msiexec.exe
              "C:\Windows\System32\msiexec.exe" /y .\62XW.NZd
              5⤵
                PID:1776
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu1185ccb71be14d.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1232
            • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu1185ccb71be14d.exe
              Thu1185ccb71be14d.exe
              4⤵
              • Executes dropped EXE
              PID:2928
              • C:\Users\Admin\Pictures\Adobe Films\6hDQ1EUCRuWWKCAjIejhNu55.exe
                "C:\Users\Admin\Pictures\Adobe Films\6hDQ1EUCRuWWKCAjIejhNu55.exe"
                5⤵
                  PID:1096
                • C:\Users\Admin\Pictures\Adobe Films\96j26SOGCNn6KY4MZv1Zap95.exe
                  "C:\Users\Admin\Pictures\Adobe Films\96j26SOGCNn6KY4MZv1Zap95.exe"
                  5⤵
                    PID:4744
                  • C:\Users\Admin\Pictures\Adobe Films\NkQt1u52SON2sRd7sBPWwM8K.exe
                    "C:\Users\Admin\Pictures\Adobe Films\NkQt1u52SON2sRd7sBPWwM8K.exe"
                    5⤵
                      PID:4736
                    • C:\Users\Admin\Pictures\Adobe Films\4tIsmTSkabDEkid3tH6S_vDR.exe
                      "C:\Users\Admin\Pictures\Adobe Films\4tIsmTSkabDEkid3tH6S_vDR.exe"
                      5⤵
                        PID:4936
                      • C:\Users\Admin\Pictures\Adobe Films\yVKGPCHydmvpEINyrMGMJkiv.exe
                        "C:\Users\Admin\Pictures\Adobe Films\yVKGPCHydmvpEINyrMGMJkiv.exe"
                        5⤵
                          PID:4928
                        • C:\Users\Admin\Pictures\Adobe Films\1yNIW0dtPVuWrpldrv5mBJCs.exe
                          "C:\Users\Admin\Pictures\Adobe Films\1yNIW0dtPVuWrpldrv5mBJCs.exe"
                          5⤵
                            PID:4900
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 664
                              6⤵
                              • Program crash
                              PID:5588
                          • C:\Users\Admin\Pictures\Adobe Films\A969a00lCtVaEQ0DrCLBIoG5.exe
                            "C:\Users\Admin\Pictures\Adobe Films\A969a00lCtVaEQ0DrCLBIoG5.exe"
                            5⤵
                              PID:4856
                            • C:\Users\Admin\Pictures\Adobe Films\pzc4zCE6_9e56a7r5EDRe4eQ.exe
                              "C:\Users\Admin\Pictures\Adobe Films\pzc4zCE6_9e56a7r5EDRe4eQ.exe"
                              5⤵
                                PID:5100
                              • C:\Users\Admin\Pictures\Adobe Films\E59243SIkeZdlAyNruJMXyFr.exe
                                "C:\Users\Admin\Pictures\Adobe Films\E59243SIkeZdlAyNruJMXyFr.exe"
                                5⤵
                                  PID:5092
                                • C:\Users\Admin\Pictures\Adobe Films\iTgyhkvRJ2YBK_tPwyQGdOqH.exe
                                  "C:\Users\Admin\Pictures\Adobe Films\iTgyhkvRJ2YBK_tPwyQGdOqH.exe"
                                  5⤵
                                    PID:5076
                                  • C:\Users\Admin\Pictures\Adobe Films\EGFT0UJCC27T6IW2USgi7RN_.exe
                                    "C:\Users\Admin\Pictures\Adobe Films\EGFT0UJCC27T6IW2USgi7RN_.exe"
                                    5⤵
                                      PID:5084
                                    • C:\Users\Admin\Pictures\Adobe Films\L0TY8FuHXOhTtbVE97lxpjYs.exe
                                      "C:\Users\Admin\Pictures\Adobe Films\L0TY8FuHXOhTtbVE97lxpjYs.exe"
                                      5⤵
                                        PID:5068
                                      • C:\Users\Admin\Pictures\Adobe Films\ZMQsB8eiWCv1vizC5Xj0Cf1J.exe
                                        "C:\Users\Admin\Pictures\Adobe Films\ZMQsB8eiWCv1vizC5Xj0Cf1J.exe"
                                        5⤵
                                          PID:5060
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                            6⤵
                                              PID:5756
                                            • C:\Windows\System32\netsh.exe
                                              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
                                              6⤵
                                                PID:5808
                                              • C:\Windows\System\svchost.exe
                                                "C:\Windows\System\svchost.exe" formal
                                                6⤵
                                                  PID:5984
                                              • C:\Users\Admin\Pictures\Adobe Films\RpE1w1iaEhX9cwnH60cQVw6C.exe
                                                "C:\Users\Admin\Pictures\Adobe Films\RpE1w1iaEhX9cwnH60cQVw6C.exe"
                                                5⤵
                                                  PID:5052
                                                  • C:\Users\Public\Videos\hgfdfds.exe
                                                    "C:\Users\Public\Videos\hgfdfds.exe"
                                                    6⤵
                                                      PID:4816
                                                  • C:\Users\Admin\Pictures\Adobe Films\Cnl6g4rFOGqnVOWMtTwBvjE7.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\Cnl6g4rFOGqnVOWMtTwBvjE7.exe"
                                                    5⤵
                                                      PID:5040
                                                      • C:\Users\Admin\AppData\Local\Temp\7zSC616.tmp\Install.exe
                                                        .\Install.exe
                                                        6⤵
                                                          PID:1124
                                                          • C:\Users\Admin\AppData\Local\Temp\7zSE0F1.tmp\Install.exe
                                                            .\Install.exe /S /site_id "525403"
                                                            7⤵
                                                              PID:1484
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                8⤵
                                                                  PID:4212
                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                    9⤵
                                                                      PID:5128
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                        10⤵
                                                                          PID:5364
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                            11⤵
                                                                              PID:5320
                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                        8⤵
                                                                          PID:3148
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                            9⤵
                                                                              PID:5280
                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                            8⤵
                                                                              PID:4328
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                9⤵
                                                                                  PID:5196
                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                    10⤵
                                                                                      PID:5232
                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                      10⤵
                                                                                        PID:5384
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /CREATE /TN "gTiNRuWZc" /SC once /ST 01:38:17 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                    8⤵
                                                                                    • Creates scheduled task(s)
                                                                                    PID:5312
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /run /I /tn "gTiNRuWZc"
                                                                                    8⤵
                                                                                      PID:5704
                                                                              • C:\Users\Admin\Pictures\Adobe Films\CNr7GyOVjJr68ZTtBBDk9pT3.exe
                                                                                "C:\Users\Admin\Pictures\Adobe Films\CNr7GyOVjJr68ZTtBBDk9pT3.exe"
                                                                                5⤵
                                                                                  PID:5032
                                                                                  • C:\Users\Admin\AppData\Local\5f888d8c-2f24-4839-978c-e60807f562ac.exe
                                                                                    "C:\Users\Admin\AppData\Local\5f888d8c-2f24-4839-978c-e60807f562ac.exe"
                                                                                    6⤵
                                                                                      PID:5916
                                                                                    • C:\Users\Admin\AppData\Local\ee4171c1-5881-4783-a137-c260bc86d283.exe
                                                                                      "C:\Users\Admin\AppData\Local\ee4171c1-5881-4783-a137-c260bc86d283.exe"
                                                                                      6⤵
                                                                                        PID:5168
                                                                                    • C:\Users\Admin\Pictures\Adobe Films\wcuhKSlWqslgz2Qet0QPZdLP.exe
                                                                                      "C:\Users\Admin\Pictures\Adobe Films\wcuhKSlWqslgz2Qet0QPZdLP.exe"
                                                                                      5⤵
                                                                                        PID:5020
                                                                                      • C:\Users\Admin\Pictures\Adobe Films\A7zdVo9BXyNxcbokck4RzWQm.exe
                                                                                        "C:\Users\Admin\Pictures\Adobe Films\A7zdVo9BXyNxcbokck4RzWQm.exe"
                                                                                        5⤵
                                                                                          PID:5008
                                                                                        • C:\Users\Admin\Pictures\Adobe Films\q4DP5Ihs3WhuG0gB0NQLmteq.exe
                                                                                          "C:\Users\Admin\Pictures\Adobe Films\q4DP5Ihs3WhuG0gB0NQLmteq.exe"
                                                                                          5⤵
                                                                                            PID:4328
                                                                                          • C:\Users\Admin\Pictures\Adobe Films\xLe6HmffavM2hZt9HI2MyORU.exe
                                                                                            "C:\Users\Admin\Pictures\Adobe Films\xLe6HmffavM2hZt9HI2MyORU.exe"
                                                                                            5⤵
                                                                                              PID:680
                                                                                            • C:\Users\Admin\Pictures\Adobe Films\FZ_a8mndiYdjZXgMhtwrOxFe.exe
                                                                                              "C:\Users\Admin\Pictures\Adobe Films\FZ_a8mndiYdjZXgMhtwrOxFe.exe"
                                                                                              5⤵
                                                                                                PID:4300
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 400
                                                                                                  6⤵
                                                                                                  • Program crash
                                                                                                  PID:4952
                                                                                              • C:\Users\Admin\Pictures\Adobe Films\CzZCONUxiAStJ59T7qxfj0eZ.exe
                                                                                                "C:\Users\Admin\Pictures\Adobe Films\CzZCONUxiAStJ59T7qxfj0eZ.exe"
                                                                                                5⤵
                                                                                                  PID:1036
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c Thu11d4773c01d6f0.exe
                                                                                              3⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3232
                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11d4773c01d6f0.exe
                                                                                                Thu11d4773c01d6f0.exe
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2000
                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11d4773c01d6f0.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11d4773c01d6f0.exe
                                                                                                  5⤵
                                                                                                    PID:2184
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c Thu11905232b5734.exe
                                                                                                3⤵
                                                                                                  PID:1368
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11905232b5734.exe
                                                                                                    Thu11905232b5734.exe
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2364
                                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                                      C:\Windows\system32\WerFault.exe -u -p 2364 -s 1976
                                                                                                      5⤵
                                                                                                      • Program crash
                                                                                                      PID:2460
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c Thu111723557c117162.exe
                                                                                                  3⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3436
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu111723557c117162.exe
                                                                                                    Thu111723557c117162.exe
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1576
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                                      5⤵
                                                                                                        PID:3676
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          taskkill /f /im chrome.exe
                                                                                                          6⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:860
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c Thu11e9a815c8cbb1a.exe
                                                                                                    3⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4012
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11e9a815c8cbb1a.exe
                                                                                                      Thu11e9a815c8cbb1a.exe
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2464
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c Thu115efe21f1a89d5.exe
                                                                                                    3⤵
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:404
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu115efe21f1a89d5.exe
                                                                                                      Thu115efe21f1a89d5.exe
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:748
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im Thu115efe21f1a89d5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu115efe21f1a89d5.exe" & del C:\ProgramData\*.dll & exit
                                                                                                        5⤵
                                                                                                          PID:4380
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            taskkill /im Thu115efe21f1a89d5.exe /f
                                                                                                            6⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:4992
                                                                                                          • C:\Windows\SysWOW64\timeout.exe
                                                                                                            timeout /t 6
                                                                                                            6⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:4288
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c Thu110155a356f.exe
                                                                                                      3⤵
                                                                                                        PID:2920
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu110155a356f.exe
                                                                                                          Thu110155a356f.exe
                                                                                                          4⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2988
                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                            "C:\Windows\System32\msiexec.exe" /y .\62XW.NZd
                                                                                                            5⤵
                                                                                                              PID:2300
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c Thu1179364c94e82.exe
                                                                                                          3⤵
                                                                                                            PID:2132
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu1179364c94e82.exe
                                                                                                              Thu1179364c94e82.exe
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2028
                                                                                                              • C:\Windows\system32\WerFault.exe
                                                                                                                C:\Windows\system32\WerFault.exe -u -p 2028 -s 1216
                                                                                                                5⤵
                                                                                                                • Program crash
                                                                                                                PID:4084
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c Thu11a637868f8aa.exe
                                                                                                            3⤵
                                                                                                              PID:3768
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11a637868f8aa.exe
                                                                                                                Thu11a637868f8aa.exe
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:3032
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11a637868f8aa.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11a637868f8aa.exe" -u
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:1616
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c Thu11f7717aa35a4ea.exe
                                                                                                              3⤵
                                                                                                                PID:1000
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11f7717aa35a4ea.exe
                                                                                                                  Thu11f7717aa35a4ea.exe
                                                                                                                  4⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:1424
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c Thu11307f0493.exe
                                                                                                                3⤵
                                                                                                                  PID:1836
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11307f0493.exe
                                                                                                                    Thu11307f0493.exe
                                                                                                                    4⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:3096
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-HDS5J.tmp\Thu11307f0493.tmp
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-HDS5J.tmp\Thu11307f0493.tmp" /SL5="$101FC,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11307f0493.exe"
                                                                                                                      5⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      PID:436
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11307f0493.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11307f0493.exe" /SILENT
                                                                                                                        6⤵
                                                                                                                          PID:1064
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-LQTF9.tmp\Thu11307f0493.tmp
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-LQTF9.tmp\Thu11307f0493.tmp" /SL5="$20216,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11307f0493.exe" /SILENT
                                                                                                                            7⤵
                                                                                                                              PID:1976
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-QK4FN.tmp\windllhost.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-QK4FN.tmp\windllhost.exe" 77
                                                                                                                                8⤵
                                                                                                                                  PID:2168
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c Thu11f281fb2df.exe
                                                                                                                        3⤵
                                                                                                                          PID:1476
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11f281fb2df.exe
                                                                                                                            Thu11f281fb2df.exe
                                                                                                                            4⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2876
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                              5⤵
                                                                                                                                PID:2004
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c Thu11f106a00ed17759.exe
                                                                                                                            3⤵
                                                                                                                              PID:2424
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11f106a00ed17759.exe
                                                                                                                                Thu11f106a00ed17759.exe
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:1588
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11f106a00ed17759.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11f106a00ed17759.exe
                                                                                                                                  5⤵
                                                                                                                                    PID:3316
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c Thu11cf387a29397511.exe /mixtwo
                                                                                                                                3⤵
                                                                                                                                  PID:1372
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11cf387a29397511.exe
                                                                                                                              Thu11cf387a29397511.exe /mixtwo
                                                                                                                              1⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              PID:844
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11cf387a29397511.exe
                                                                                                                                Thu11cf387a29397511.exe /mixtwo
                                                                                                                                2⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:3784
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "Thu11cf387a29397511.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS4B2AC406\Thu11cf387a29397511.exe" & exit
                                                                                                                                  3⤵
                                                                                                                                    PID:3208
                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                      taskkill /im "Thu11cf387a29397511.exe" /f
                                                                                                                                      4⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      PID:2452
                                                                                                                              • C:\Windows\system32\rundll32.exe
                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                1⤵
                                                                                                                                • Process spawned unexpected child process
                                                                                                                                PID:4228
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                  2⤵
                                                                                                                                    PID:4256
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                  1⤵
                                                                                                                                    PID:4396

                                                                                                                                  Network

                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                        Replay Monitor

                                                                                                                                        Loading Replay Monitor...

                                                                                                                                        Downloads

                                                                                                                                        • memory/436-262-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/748-273-0x0000000000400000-0x00000000008B0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.7MB

                                                                                                                                        • memory/748-265-0x0000000000C30000-0x0000000000CAC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          496KB

                                                                                                                                        • memory/748-271-0x0000000000DD0000-0x0000000000EA5000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          852KB

                                                                                                                                        • memory/1064-259-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          816KB

                                                                                                                                        • memory/1424-276-0x00000000001C0000-0x00000000001C9000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          36KB

                                                                                                                                        • memory/1424-280-0x0000000000400000-0x000000000083D000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4.2MB

                                                                                                                                        • memory/1424-267-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          36KB

                                                                                                                                        • memory/1544-294-0x0000000008150000-0x00000000081C6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          472KB

                                                                                                                                        • memory/1544-239-0x0000000007250000-0x0000000007878000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          6.2MB

                                                                                                                                        • memory/1544-310-0x0000000001040000-0x0000000001041000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1544-263-0x00000000070B0000-0x00000000070D2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/1544-206-0x0000000001040000-0x0000000001041000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1544-202-0x0000000001040000-0x0000000001041000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1544-237-0x0000000006C12000-0x0000000006C13000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1544-275-0x0000000007A10000-0x0000000007D60000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.3MB

                                                                                                                                        • memory/1544-290-0x0000000007D60000-0x0000000007D7C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          112KB

                                                                                                                                        • memory/1544-231-0x0000000001240000-0x0000000001276000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          216KB

                                                                                                                                        • memory/1544-272-0x0000000007980000-0x00000000079E6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                        • memory/1544-292-0x0000000008390000-0x00000000083DB000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          300KB

                                                                                                                                        • memory/1544-269-0x0000000007150000-0x00000000071B6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                        • memory/1544-240-0x0000000006C10000-0x0000000006C11000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1588-248-0x0000000005830000-0x0000000005831000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1588-279-0x0000000006020000-0x000000000651E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          5.0MB

                                                                                                                                        • memory/1588-224-0x0000000000EE0000-0x0000000000F6C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          560KB

                                                                                                                                        • memory/1588-249-0x0000000005730000-0x000000000574E000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                        • memory/1588-230-0x0000000000EE0000-0x0000000000F6C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          560KB

                                                                                                                                        • memory/1588-250-0x0000000003160000-0x0000000003161000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1588-242-0x0000000005750000-0x00000000057C6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          472KB

                                                                                                                                        • memory/1684-266-0x00000000073A0000-0x0000000007406000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                        • memory/1684-291-0x0000000007F70000-0x0000000007FBB000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          300KB

                                                                                                                                        • memory/1684-312-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1684-210-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1684-236-0x0000000006D70000-0x0000000007398000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          6.2MB

                                                                                                                                        • memory/1684-221-0x0000000001270000-0x0000000001271000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1684-204-0x00000000007D0000-0x00000000007D1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1684-274-0x0000000007580000-0x00000000078D0000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          3.3MB

                                                                                                                                        • memory/1684-260-0x0000000006CA0000-0x0000000006CC2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          136KB

                                                                                                                                        • memory/1684-293-0x0000000007D70000-0x0000000007DE6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          472KB

                                                                                                                                        • memory/1684-289-0x0000000007930000-0x000000000794C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          112KB

                                                                                                                                        • memory/1684-228-0x0000000001110000-0x0000000001146000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          216KB

                                                                                                                                        • memory/1684-234-0x0000000001272000-0x0000000001273000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1684-270-0x0000000006CD0000-0x0000000006D36000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          408KB

                                                                                                                                        • memory/1776-251-0x0000000000280000-0x0000000000281000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1776-253-0x0000000000280000-0x0000000000281000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/1976-278-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2000-243-0x00000000049F0000-0x0000000004A66000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          472KB

                                                                                                                                        • memory/2000-255-0x00000000049E0000-0x00000000049E1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2000-256-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2000-222-0x00000000000B0000-0x000000000013C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          560KB

                                                                                                                                        • memory/2000-277-0x00000000051B0000-0x00000000056AE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          5.0MB

                                                                                                                                        • memory/2000-219-0x00000000000B0000-0x000000000013C000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          560KB

                                                                                                                                        • memory/2000-252-0x00000000024B0000-0x00000000024CE000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          120KB

                                                                                                                                        • memory/2004-321-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          340KB

                                                                                                                                        • memory/2028-196-0x0000000000730000-0x0000000000738000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/2028-218-0x000000001B3D0000-0x000000001B3D2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/2028-197-0x0000000000730000-0x0000000000738000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          32KB

                                                                                                                                        • memory/2184-306-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                        • memory/2184-305-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                        • memory/2184-295-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                        • memory/2184-307-0x0000000005740000-0x0000000005D46000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          6.0MB

                                                                                                                                        • memory/2300-283-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2300-284-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2364-201-0x0000000000290000-0x00000000002AC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          112KB

                                                                                                                                        • memory/2364-225-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          24KB

                                                                                                                                        • memory/2364-235-0x000000001AEB0000-0x000000001AEB2000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          8KB

                                                                                                                                        • memory/2364-207-0x0000000000290000-0x00000000002AC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          112KB

                                                                                                                                        • memory/2752-177-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2752-170-0x0000000000660000-0x0000000000661000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2988-212-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/2988-217-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          4KB

                                                                                                                                        • memory/3068-308-0x00000000010C0000-0x00000000010D6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          88KB

                                                                                                                                        • memory/3096-229-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          816KB

                                                                                                                                        • memory/3316-302-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                        • memory/3316-296-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                        • memory/3316-303-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          128KB

                                                                                                                                        • memory/3700-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          100KB

                                                                                                                                        • memory/3700-134-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          100KB

                                                                                                                                        • memory/3700-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          572KB

                                                                                                                                        • memory/3700-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          572KB

                                                                                                                                        • memory/3700-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.5MB

                                                                                                                                        • memory/3700-136-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          100KB

                                                                                                                                        • memory/3700-141-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          152KB

                                                                                                                                        • memory/3700-131-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          100KB

                                                                                                                                        • memory/3700-140-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.5MB

                                                                                                                                        • memory/3700-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.5MB

                                                                                                                                        • memory/3700-133-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          572KB

                                                                                                                                        • memory/3700-137-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          1.5MB

                                                                                                                                        • memory/3784-220-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          320KB

                                                                                                                                        • memory/3784-233-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                          Filesize

                                                                                                                                          320KB