Analysis

  • max time kernel
    21s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    26/12/2021, 15:37

General

  • Target

    ad763d76409ed44f9cfb8b2ed65499e5.exe

  • Size

    6.3MB

  • MD5

    ad763d76409ed44f9cfb8b2ed65499e5

  • SHA1

    4c67c4a9b13880d68a324b646d58523b7d7c66b2

  • SHA256

    cc2d611eb3f0e462f0c136b1664348fc05669fbac46ebb4b28c900c4dff94318

  • SHA512

    5eed101dc0b24c72c957573a675080b8c7cf9c279cfa5b0ed37a12d03cd934400442003abd3d1c0aff042b67fe4be8d12611f88ef56653736f8595258e38bace

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.2

Botnet

915

C2

https://mstdn.social/@kipriauk9

https://qoto.org/@kipriauk8

Attributes
  • profile_id

    915

Extracted

Family

redline

Botnet

media24pns

C2

65.108.69.168:13293

Extracted

Family

redline

Botnet

userv1

C2

159.69.246.184:13127

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 10 IoCs
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 5 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 7 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 10 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 4 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad763d76409ed44f9cfb8b2ed65499e5.exe
    "C:\Users\Admin\AppData\Local\Temp\ad763d76409ed44f9cfb8b2ed65499e5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3508
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1060
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2792
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2052
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Thu11c4a8f1b4.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe
          Thu11c4a8f1b4.exe
          4⤵
          • Executes dropped EXE
          PID:1104
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c Thu1156c5ba90d95.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1156c5ba90d95.exe
          Thu1156c5ba90d95.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:716
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c taskkill /f /im chrome.exe
            5⤵
              PID:4888
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im chrome.exe
                6⤵
                • Kills process with taskkill
                PID:5092
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Thu11bb8ff185f.exe
          3⤵
            PID:4088
            • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11bb8ff185f.exe
              Thu11bb8ff185f.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:4076
              • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11bb8ff185f.exe
                C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11bb8ff185f.exe
                5⤵
                • Executes dropped EXE
                PID:1012
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu11b566ea7ac6697c5.exe
            3⤵
              PID:3104
              • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11b566ea7ac6697c5.exe
                Thu11b566ea7ac6697c5.exe
                4⤵
                • Executes dropped EXE
                PID:1868
                • C:\Windows\SysWOW64\msiexec.exe
                  "C:\Windows\System32\msiexec.exe" /y .\62XW.NZd
                  5⤵
                  • Loads dropped DLL
                  PID:2936
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu1176d60b7fec40.exe
              3⤵
                PID:3916
                • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1176d60b7fec40.exe
                  Thu1176d60b7fec40.exe
                  4⤵
                  • Executes dropped EXE
                  PID:1936
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Thu11fc58bc54.exe
                3⤵
                  PID:68
                  • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11fc58bc54.exe
                    Thu11fc58bc54.exe
                    4⤵
                    • Executes dropped EXE
                    PID:1360
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Thu11c4d5223f5.exe
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3472
                  • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4d5223f5.exe
                    Thu11c4d5223f5.exe
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1008
                    • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4d5223f5.exe
                      C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4d5223f5.exe
                      5⤵
                      • Executes dropped EXE
                      PID:704
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Thu112a7360c8b.exe
                  3⤵
                    PID:2704
                    • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu112a7360c8b.exe
                      Thu112a7360c8b.exe
                      4⤵
                      • Executes dropped EXE
                      PID:1536
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /im Thu112a7360c8b.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu112a7360c8b.exe" & del C:\ProgramData\*.dll & exit
                        5⤵
                          PID:2600
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /im Thu112a7360c8b.exe /f
                            6⤵
                            • Kills process with taskkill
                            PID:1264
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 6
                            6⤵
                            • Delays execution with timeout.exe
                            PID:4488
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Thu11857de850e10c9f1.exe
                      3⤵
                        PID:1092
                        • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11857de850e10c9f1.exe
                          Thu11857de850e10c9f1.exe
                          4⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1660
                          • C:\Users\Admin\AppData\Local\e34b04a4-fd86-45e2-baac-2546895d4016.exe
                            "C:\Users\Admin\AppData\Local\e34b04a4-fd86-45e2-baac-2546895d4016.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4196
                          • C:\Users\Admin\AppData\Local\4175b3cc-687e-4e7d-a606-59906f95ead2.exe
                            "C:\Users\Admin\AppData\Local\4175b3cc-687e-4e7d-a606-59906f95ead2.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4232
                            • C:\Users\Admin\AppData\Roaming\8265817.exe
                              "C:\Users\Admin\AppData\Roaming\8265817.exe"
                              6⤵
                                PID:4920
                                • C:\Windows\SysWOW64\control.exe
                                  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",
                                  7⤵
                                    PID:4536
                                    • C:\Windows\SysWOW64\rundll32.exe
                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",
                                      8⤵
                                        PID:4176
                                        • C:\Windows\system32\RunDll32.exe
                                          C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",
                                          9⤵
                                            PID:2792
                                            • C:\Windows\SysWOW64\rundll32.exe
                                              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\0nD~1.CPl",
                                              10⤵
                                                PID:4212
                                    • C:\Users\Admin\AppData\Local\3b11eeec-d86a-4279-8790-f1d6d4a73fc0.exe
                                      "C:\Users\Admin\AppData\Local\3b11eeec-d86a-4279-8790-f1d6d4a73fc0.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      PID:3932
                                      • C:\Users\Admin\AppData\Roaming\33691759\3369109633691096.exe
                                        "C:\Users\Admin\AppData\Roaming\33691759\3369109633691096.exe"
                                        6⤵
                                          PID:4636
                                      • C:\Users\Admin\AppData\Local\011a2f3d-3bf0-4bcf-8901-7fc2f21ea7ca.exe
                                        "C:\Users\Admin\AppData\Local\011a2f3d-3bf0-4bcf-8901-7fc2f21ea7ca.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        PID:1932
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c Thu11a0bd61b27d20c5.exe /mixtwo
                                    3⤵
                                      PID:372
                                      • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11a0bd61b27d20c5.exe
                                        Thu11a0bd61b27d20c5.exe /mixtwo
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:1716
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Thu11d2de72527d6d7d.exe
                                      3⤵
                                        PID:316
                                        • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11d2de72527d6d7d.exe
                                          Thu11d2de72527d6d7d.exe
                                          4⤵
                                          • Executes dropped EXE
                                          PID:2436
                                          • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                            C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            5⤵
                                            • Executes dropped EXE
                                            PID:2316
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Thu11c668614fd663.exe
                                        3⤵
                                          PID:3640
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Thu11db26fe3a1.exe
                                          3⤵
                                            PID:1376
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Thu1187a4fcf7bfdc.exe
                                            3⤵
                                              PID:2524
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Thu11b21c69a3797.exe
                                              3⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3956
                                        • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11b21c69a3797.exe
                                          Thu11b21c69a3797.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1380
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 1380 -s 2016
                                            2⤵
                                            • Program crash
                                            PID:4836
                                        • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1187a4fcf7bfdc.exe
                                          Thu1187a4fcf7bfdc.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:1128
                                          • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1187a4fcf7bfdc.exe
                                            "C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu1187a4fcf7bfdc.exe" -u
                                            2⤵
                                            • Executes dropped EXE
                                            PID:2824
                                        • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c668614fd663.exe
                                          Thu11c668614fd663.exe
                                          1⤵
                                          • Executes dropped EXE
                                          PID:1396
                                          • C:\Users\Admin\Pictures\Adobe Films\_bSpgoaMu3FZzyn0e_vkYbzE.exe
                                            "C:\Users\Admin\Pictures\Adobe Films\_bSpgoaMu3FZzyn0e_vkYbzE.exe"
                                            2⤵
                                              PID:3808
                                            • C:\Users\Admin\Pictures\Adobe Films\V2gM9BSf23MRqQXJdebiDxEp.exe
                                              "C:\Users\Admin\Pictures\Adobe Films\V2gM9BSf23MRqQXJdebiDxEp.exe"
                                              2⤵
                                                PID:3604
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im V2gM9BSf23MRqQXJdebiDxEp.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\V2gM9BSf23MRqQXJdebiDxEp.exe" & del C:\ProgramData\*.dll & exit
                                                  3⤵
                                                    PID:2884
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /im V2gM9BSf23MRqQXJdebiDxEp.exe /f
                                                      4⤵
                                                      • Kills process with taskkill
                                                      PID:3980
                                                • C:\Users\Admin\Pictures\Adobe Films\cxc_WLLx3Y0pNNbstOrOAcaL.exe
                                                  "C:\Users\Admin\Pictures\Adobe Films\cxc_WLLx3Y0pNNbstOrOAcaL.exe"
                                                  2⤵
                                                    PID:4132
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 664
                                                      3⤵
                                                      • Program crash
                                                      PID:4940
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 680
                                                      3⤵
                                                      • Program crash
                                                      PID:4808
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 640
                                                      3⤵
                                                      • Program crash
                                                      PID:4960
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 672
                                                      3⤵
                                                      • Program crash
                                                      PID:764
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 896
                                                      3⤵
                                                      • Program crash
                                                      PID:1920
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1160
                                                      3⤵
                                                      • Program crash
                                                      PID:1824
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1124
                                                      3⤵
                                                      • Program crash
                                                      PID:700
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 4132 -s 1272
                                                      3⤵
                                                      • Program crash
                                                      PID:1384
                                                  • C:\Users\Admin\Pictures\Adobe Films\zAGXS0GZxHCLigIrOP9OyPBT.exe
                                                    "C:\Users\Admin\Pictures\Adobe Films\zAGXS0GZxHCLigIrOP9OyPBT.exe"
                                                    2⤵
                                                      PID:1220
                                                    • C:\Users\Admin\Pictures\Adobe Films\6gJZOXHkXB88iYMvazLx9MGY.exe
                                                      "C:\Users\Admin\Pictures\Adobe Films\6gJZOXHkXB88iYMvazLx9MGY.exe"
                                                      2⤵
                                                        PID:2116
                                                      • C:\Users\Admin\Pictures\Adobe Films\0MOEaydNL1UVIRRmPbrBOBmU.exe
                                                        "C:\Users\Admin\Pictures\Adobe Films\0MOEaydNL1UVIRRmPbrBOBmU.exe"
                                                        2⤵
                                                          PID:4508
                                                        • C:\Users\Admin\Pictures\Adobe Films\_8ai3yQW6FPO01hOzEIncRVr.exe
                                                          "C:\Users\Admin\Pictures\Adobe Films\_8ai3yQW6FPO01hOzEIncRVr.exe"
                                                          2⤵
                                                            PID:4936
                                                            • C:\Users\Admin\AppData\Local\330a2e88-7cbd-4836-8a7f-07367570c0d4.exe
                                                              "C:\Users\Admin\AppData\Local\330a2e88-7cbd-4836-8a7f-07367570c0d4.exe"
                                                              3⤵
                                                                PID:1680
                                                              • C:\Users\Admin\AppData\Local\99680099-a670-4a95-9e99-82bbd31051e7.exe
                                                                "C:\Users\Admin\AppData\Local\99680099-a670-4a95-9e99-82bbd31051e7.exe"
                                                                3⤵
                                                                  PID:836
                                                                • C:\Users\Admin\AppData\Local\d380bb0b-1963-4481-a09e-38a49cfb97d1.exe
                                                                  "C:\Users\Admin\AppData\Local\d380bb0b-1963-4481-a09e-38a49cfb97d1.exe"
                                                                  3⤵
                                                                    PID:4868
                                                                  • C:\Users\Admin\AppData\Local\19b7f440-da07-4d03-a4be-425061ac7dcc.exe
                                                                    "C:\Users\Admin\AppData\Local\19b7f440-da07-4d03-a4be-425061ac7dcc.exe"
                                                                    3⤵
                                                                      PID:4912
                                                                  • C:\Users\Admin\Pictures\Adobe Films\oZw99uWuckiiTMPo4jXmO8we.exe
                                                                    "C:\Users\Admin\Pictures\Adobe Films\oZw99uWuckiiTMPo4jXmO8we.exe"
                                                                    2⤵
                                                                      PID:4432
                                                                    • C:\Users\Admin\Pictures\Adobe Films\hnDZHPCjimYyhkuQNEN2UzYY.exe
                                                                      "C:\Users\Admin\Pictures\Adobe Films\hnDZHPCjimYyhkuQNEN2UzYY.exe"
                                                                      2⤵
                                                                        PID:372
                                                                        • C:\Users\Admin\Documents\yEf2igUUw8rudmU2nVprf9hp.exe
                                                                          "C:\Users\Admin\Documents\yEf2igUUw8rudmU2nVprf9hp.exe"
                                                                          3⤵
                                                                            PID:1396
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                            3⤵
                                                                            • Creates scheduled task(s)
                                                                            PID:3976
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                            3⤵
                                                                            • Creates scheduled task(s)
                                                                            PID:2184
                                                                        • C:\Users\Admin\Pictures\Adobe Films\SXk4YsAHlGIXtTwxOODY2ilu.exe
                                                                          "C:\Users\Admin\Pictures\Adobe Films\SXk4YsAHlGIXtTwxOODY2ilu.exe"
                                                                          2⤵
                                                                            PID:5020
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                              #cmd
                                                                              3⤵
                                                                                PID:4500
                                                                            • C:\Users\Admin\Pictures\Adobe Films\ltaV8XFB8ZSC1JSdTlaAHyKe.exe
                                                                              "C:\Users\Admin\Pictures\Adobe Films\ltaV8XFB8ZSC1JSdTlaAHyKe.exe"
                                                                              2⤵
                                                                                PID:3056
                                                                              • C:\Users\Admin\Pictures\Adobe Films\1ZIOvo98BnWNoJ3ryGTmkxYP.exe
                                                                                "C:\Users\Admin\Pictures\Adobe Films\1ZIOvo98BnWNoJ3ryGTmkxYP.exe"
                                                                                2⤵
                                                                                  PID:4564
                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSEA2D.tmp\Install.exe
                                                                                    .\Install.exe
                                                                                    3⤵
                                                                                      PID:1540
                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSF5A7.tmp\Install.exe
                                                                                        .\Install.exe /S /site_id "525403"
                                                                                        4⤵
                                                                                          PID:4476
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &
                                                                                            5⤵
                                                                                              PID:4488
                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"
                                                                                                6⤵
                                                                                                  PID:4644
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                    7⤵
                                                                                                      PID:1076
                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True
                                                                                                        8⤵
                                                                                                          PID:4528
                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
                                                                                                    5⤵
                                                                                                      PID:4880
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                        6⤵
                                                                                                          PID:3768
                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                            7⤵
                                                                                                              PID:4612
                                                                                                            • \??\c:\windows\SysWOW64\reg.exe
                                                                                                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                                                                                                              7⤵
                                                                                                                PID:4468
                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
                                                                                                            5⤵
                                                                                                              PID:4320
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                                6⤵
                                                                                                                  PID:4804
                                                                                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                                    7⤵
                                                                                                                      PID:5012
                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                                                                                                                      7⤵
                                                                                                                        PID:4592
                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                    schtasks /CREATE /TN "glDhdqFsc" /SC once /ST 12:59:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                    5⤵
                                                                                                                    • Creates scheduled task(s)
                                                                                                                    PID:4664
                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\vc0v70ph0c7ww8dYdh6dMVtd.exe
                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\vc0v70ph0c7ww8dYdh6dMVtd.exe"
                                                                                                              2⤵
                                                                                                                PID:4168
                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\EGrN5MJ0qGUv33AjUGGoLYBB.exe
                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\EGrN5MJ0qGUv33AjUGGoLYBB.exe"
                                                                                                                2⤵
                                                                                                                  PID:2708
                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\nk1DRguj1eHV3aQLO6BwM23Z.exe
                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\nk1DRguj1eHV3aQLO6BwM23Z.exe"
                                                                                                                  2⤵
                                                                                                                    PID:1252
                                                                                                                    • C:\Users\Public\Videos\hgfdfds.exe
                                                                                                                      "C:\Users\Public\Videos\hgfdfds.exe"
                                                                                                                      3⤵
                                                                                                                        PID:2904
                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\xT0wSrD98kxNd9PO32Eo5Z5o.exe
                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\xT0wSrD98kxNd9PO32Eo5Z5o.exe"
                                                                                                                      2⤵
                                                                                                                        PID:4516
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\wfvStpOzRepe5\EasyCalc License Agreement.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\wfvStpOzRepe5\EasyCalc License Agreement.exe"
                                                                                                                          3⤵
                                                                                                                            PID:5324
                                                                                                                        • C:\Users\Admin\Pictures\Adobe Films\RD46IbVk80V5IgkDihYqK4Yv.exe
                                                                                                                          "C:\Users\Admin\Pictures\Adobe Films\RD46IbVk80V5IgkDihYqK4Yv.exe"
                                                                                                                          2⤵
                                                                                                                            PID:2524
                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\LQVkjXmg8goR37YpwaLB5Fnc.exe
                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\LQVkjXmg8goR37YpwaLB5Fnc.exe"
                                                                                                                            2⤵
                                                                                                                              PID:1980
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                3⤵
                                                                                                                                  PID:4712
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                  3⤵
                                                                                                                                    PID:716
                                                                                                                                • C:\Users\Admin\Pictures\Adobe Films\9eBrpMc7IVoQr8Xf9DN0Itg7.exe
                                                                                                                                  "C:\Users\Admin\Pictures\Adobe Films\9eBrpMc7IVoQr8Xf9DN0Itg7.exe"
                                                                                                                                  2⤵
                                                                                                                                    PID:1120
                                                                                                                                  • C:\Users\Admin\Pictures\Adobe Films\OYkwmzTrguYodZTCoC3sw6JL.exe
                                                                                                                                    "C:\Users\Admin\Pictures\Adobe Films\OYkwmzTrguYodZTCoC3sw6JL.exe"
                                                                                                                                    2⤵
                                                                                                                                      PID:4680
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 400
                                                                                                                                        3⤵
                                                                                                                                        • Program crash
                                                                                                                                        PID:3064
                                                                                                                                    • C:\Users\Admin\Pictures\Adobe Films\02XIqzfbSdWUTpVjedofSyGx.exe
                                                                                                                                      "C:\Users\Admin\Pictures\Adobe Films\02XIqzfbSdWUTpVjedofSyGx.exe"
                                                                                                                                      2⤵
                                                                                                                                        PID:4688
                                                                                                                                      • C:\Users\Admin\Pictures\Adobe Films\df5aBk1XAe0fUHE_LHn5yxgq.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Adobe Films\df5aBk1XAe0fUHE_LHn5yxgq.exe"
                                                                                                                                        2⤵
                                                                                                                                          PID:4716
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-ACF3F.tmp\df5aBk1XAe0fUHE_LHn5yxgq.tmp
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-ACF3F.tmp\df5aBk1XAe0fUHE_LHn5yxgq.tmp" /SL5="$302CC,140559,56832,C:\Users\Admin\Pictures\Adobe Films\df5aBk1XAe0fUHE_LHn5yxgq.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:3984
                                                                                                                                          • C:\Users\Admin\Pictures\Adobe Films\lsxTFGEgtCGMsiX5kZQ8pjNV.exe
                                                                                                                                            "C:\Users\Admin\Pictures\Adobe Films\lsxTFGEgtCGMsiX5kZQ8pjNV.exe"
                                                                                                                                            2⤵
                                                                                                                                              PID:3924
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-TQ5OM.tmp\lsxTFGEgtCGMsiX5kZQ8pjNV.tmp
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-TQ5OM.tmp\lsxTFGEgtCGMsiX5kZQ8pjNV.tmp" /SL5="$302CA,140559,56832,C:\Users\Admin\Pictures\Adobe Films\lsxTFGEgtCGMsiX5kZQ8pjNV.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:4980
                                                                                                                                              • C:\Users\Admin\Pictures\Adobe Films\ZxJCH40kVq7FNcViM_6V5AfJ.exe
                                                                                                                                                "C:\Users\Admin\Pictures\Adobe Films\ZxJCH40kVq7FNcViM_6V5AfJ.exe"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1564
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11a0bd61b27d20c5.exe
                                                                                                                                                Thu11a0bd61b27d20c5.exe /mixtwo
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:948
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "Thu11a0bd61b27d20c5.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11a0bd61b27d20c5.exe" & exit
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4648
                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                      taskkill /im "Thu11a0bd61b27d20c5.exe" /f
                                                                                                                                                      3⤵
                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                      PID:4932
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-TTEST.tmp\Thu11c4a8f1b4.tmp
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-TTEST.tmp\Thu11c4a8f1b4.tmp" /SL5="$201AA,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe"
                                                                                                                                                  1⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                  PID:1228
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe" /SILENT
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2720
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-4O2RB.tmp\Thu11c4a8f1b4.tmp
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-4O2RB.tmp\Thu11c4a8f1b4.tmp" /SL5="$20202,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11c4a8f1b4.exe" /SILENT
                                                                                                                                                      3⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      PID:1468
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-69VFF.tmp\windllhost.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-69VFF.tmp\windllhost.exe" 77
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5100
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS41AE6BE5\Thu11db26fe3a1.exe
                                                                                                                                                    Thu11db26fe3a1.exe
                                                                                                                                                    1⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:2992
                                                                                                                                                    • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                      "C:\Windows\System32\msiexec.exe" /y .\62XW.NZd
                                                                                                                                                      2⤵
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      PID:1204
                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                    1⤵
                                                                                                                                                    • Process spawned unexpected child process
                                                                                                                                                    PID:4460
                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1948
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2740

                                                                                                                                                      Network

                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • memory/704-290-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                            • memory/704-302-0x0000000005A70000-0x0000000006076000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.0MB

                                                                                                                                                            • memory/704-284-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                            • memory/704-309-0x00000000055F0000-0x00000000056FA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.0MB

                                                                                                                                                            • memory/704-274-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                            • memory/704-305-0x00000000054C0000-0x00000000054D2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              72KB

                                                                                                                                                            • memory/948-216-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              320KB

                                                                                                                                                            • memory/948-236-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              320KB

                                                                                                                                                            • memory/1008-244-0x0000000004C70000-0x0000000004CE6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              472KB

                                                                                                                                                            • memory/1008-230-0x00000000003B0000-0x000000000043C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              560KB

                                                                                                                                                            • memory/1008-253-0x00000000054D0000-0x00000000059CE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.0MB

                                                                                                                                                            • memory/1008-226-0x00000000003B0000-0x000000000043C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              560KB

                                                                                                                                                            • memory/1008-248-0x0000000004C00000-0x0000000004C1E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              120KB

                                                                                                                                                            • memory/1008-249-0x0000000002580000-0x0000000002581000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1008-246-0x0000000004C60000-0x0000000004C61000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1012-311-0x0000000005440000-0x000000000554A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.0MB

                                                                                                                                                            • memory/1012-289-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                            • memory/1012-319-0x0000000005370000-0x00000000053AE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              248KB

                                                                                                                                                            • memory/1012-306-0x0000000005310000-0x0000000005322000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              72KB

                                                                                                                                                            • memory/1012-303-0x0000000005870000-0x0000000005E76000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.0MB

                                                                                                                                                            • memory/1012-278-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                            • memory/1012-292-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                            • memory/1060-298-0x0000000007A90000-0x0000000007DE0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                            • memory/1060-240-0x0000000007220000-0x0000000007848000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                            • memory/1060-293-0x0000000007110000-0x0000000007176000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                            • memory/1060-372-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1060-217-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1060-231-0x0000000006BE0000-0x0000000006BE1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1060-233-0x0000000004970000-0x00000000049A6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              216KB

                                                                                                                                                            • memory/1060-268-0x0000000007070000-0x0000000007092000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              136KB

                                                                                                                                                            • memory/1060-221-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1060-237-0x0000000006BE2000-0x0000000006BE3000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1060-286-0x00000000079C0000-0x0000000007A26000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                            • memory/1104-225-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              816KB

                                                                                                                                                            • memory/1204-307-0x0000000000440000-0x0000000000441000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1204-308-0x0000000000440000-0x0000000000441000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1228-239-0x0000000000A00000-0x0000000000A01000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1360-257-0x00000000001D0000-0x00000000001D9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              36KB

                                                                                                                                                            • memory/1360-256-0x0000000000030000-0x0000000000039000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              36KB

                                                                                                                                                            • memory/1360-259-0x0000000000400000-0x000000000083D000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.2MB

                                                                                                                                                            • memory/1380-197-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32KB

                                                                                                                                                            • memory/1380-206-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              32KB

                                                                                                                                                            • memory/1380-234-0x0000000002CB0000-0x0000000002CB2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                            • memory/1468-301-0x0000000000910000-0x0000000000911000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1536-254-0x0000000000C20000-0x0000000000C9C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              496KB

                                                                                                                                                            • memory/1536-258-0x0000000000400000-0x00000000008B0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4.7MB

                                                                                                                                                            • memory/1536-255-0x0000000000DC0000-0x0000000000E95000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              852KB

                                                                                                                                                            • memory/1660-212-0x00000000005A0000-0x00000000005BC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              112KB

                                                                                                                                                            • memory/1660-229-0x000000001B150000-0x000000001B152000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                            • memory/1660-219-0x0000000000CB0000-0x0000000000CB6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              24KB

                                                                                                                                                            • memory/1660-214-0x00000000005A0000-0x00000000005BC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              112KB

                                                                                                                                                            • memory/1868-187-0x0000000000610000-0x0000000000611000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1868-186-0x0000000000610000-0x0000000000611000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/1932-318-0x0000000000E40000-0x0000000000ECA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              552KB

                                                                                                                                                            • memory/2052-218-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2052-285-0x0000000007400000-0x0000000007466000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                            • memory/2052-241-0x0000000006AA0000-0x00000000070C8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              6.2MB

                                                                                                                                                            • memory/2052-371-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2052-296-0x0000000007390000-0x00000000073F6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              408KB

                                                                                                                                                            • memory/2052-222-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2052-238-0x0000000006462000-0x0000000006463000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2052-263-0x0000000007100000-0x0000000007122000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              136KB

                                                                                                                                                            • memory/2052-235-0x00000000063E0000-0x0000000006416000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              216KB

                                                                                                                                                            • memory/2052-300-0x00000000074A0000-0x00000000077F0000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              3.3MB

                                                                                                                                                            • memory/2052-242-0x0000000006460000-0x0000000006461000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2316-276-0x0000000000400000-0x0000000000455000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              340KB

                                                                                                                                                            • memory/2720-267-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              816KB

                                                                                                                                                            • memory/2936-271-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2936-270-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2936-297-0x00000000051D0000-0x000000002FB36000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              681.4MB

                                                                                                                                                            • memory/2992-213-0x0000000000080000-0x0000000000081000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/2992-210-0x0000000000080000-0x0000000000081000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/3508-135-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                            • memory/3508-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                            • memory/3508-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              572KB

                                                                                                                                                            • memory/3508-141-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                            • memory/3508-139-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              152KB

                                                                                                                                                            • memory/3508-131-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              572KB

                                                                                                                                                            • memory/3508-138-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                            • memory/3508-140-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                            • memory/3508-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                            • memory/3508-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                            • memory/3508-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              572KB

                                                                                                                                                            • memory/3508-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                            • memory/4076-247-0x0000000005130000-0x000000000514E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              120KB

                                                                                                                                                            • memory/4076-252-0x00000000059E0000-0x0000000005EDE000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.0MB

                                                                                                                                                            • memory/4076-224-0x00000000008E0000-0x000000000096C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              560KB

                                                                                                                                                            • memory/4076-228-0x00000000008E0000-0x000000000096C000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              560KB

                                                                                                                                                            • memory/4076-250-0x00000000051D0000-0x00000000051D1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/4076-251-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/4076-245-0x00000000051E0000-0x0000000005256000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              472KB

                                                                                                                                                            • memory/4196-335-0x0000000000F20000-0x00000000010ED000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                            • memory/4196-357-0x00000000767C0000-0x0000000076D44000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              5.5MB

                                                                                                                                                            • memory/4196-361-0x00000000745A0000-0x00000000758E8000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              19.3MB

                                                                                                                                                            • memory/4196-338-0x00000000005C0000-0x00000000005C1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/4196-333-0x0000000000F20000-0x00000000010ED000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                            • memory/4196-340-0x0000000076EC0000-0x0000000077082000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                            • memory/4196-367-0x000000006F3E0000-0x000000006F42B000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              300KB

                                                                                                                                                            • memory/4196-343-0x0000000075A30000-0x0000000075B21000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              964KB

                                                                                                                                                            • memory/4196-348-0x0000000070AD0000-0x0000000070B50000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              512KB

                                                                                                                                                            • memory/4920-396-0x0000000000830000-0x0000000000831000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                            • memory/4920-394-0x0000000000830000-0x0000000000831000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB