Analysis

  • max time kernel
    162s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-03-2022 06:46

General

  • Target

    9631d8bd74d4a0384cae4396e9b0fa5f5898496028e24a274f3d571ce5c22b3a.exe

  • Size

    3.2MB

  • MD5

    5692bc30e83b7a435a60f1d76794db03

  • SHA1

    b7b37a93db95321fb31c57645b4c61e1c5e4fc77

  • SHA256

    9631d8bd74d4a0384cae4396e9b0fa5f5898496028e24a274f3d571ce5c22b3a

  • SHA512

    12751643c5bb0938aff3535c86c4977e66c44920ced333a69922c4bc86286bad9df98de896d9c54d347a7465fe0373999bff65ac11f485d50e27ef469d847d0a

Malware Config

Extracted

Family

socelars

C2

http://www.fddnice.pw/

http://www.sokoinfo.pw/

http://www.zzhlike.pw/

http://www.wygexde.xyz/

Extracted

Family

smokeloader

Version

2020

C2

http://perseus007.xyz/upload/

http://lambos1.xyz/upload/

http://cipluks.com/upload/

http://ragnar77.com/upload/

http://aslauk.com/upload/

http://qunersoo.xyz/upload /

http://hostunes.info/upload/

http://leonisdas.xyz/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

v113

C2

45.150.67.141:8054

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

  • Executes dropped EXE 10 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 7 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
    1⤵
      PID:388
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2712
      • C:\Windows\system32\wbem\WMIADAP.EXE
        wmiadap.exe /F /T /R
        2⤵
          PID:3620
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
        1⤵
        • Suspicious use of SetThreadContext
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5064
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:2812
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
        1⤵
        • Modifies data under HKEY_USERS
        PID:3496
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
        1⤵
          PID:2732
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
          1⤵
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          PID:2680
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
          1⤵
            PID:2472
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
            1⤵
              PID:1372
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
              1⤵
                PID:1616
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                1⤵
                  PID:1476
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                  1⤵
                    PID:1336
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                    1⤵
                      PID:1204
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:1132
                    • C:\Users\Admin\AppData\Local\Temp\9631d8bd74d4a0384cae4396e9b0fa5f5898496028e24a274f3d571ce5c22b3a.exe
                      "C:\Users\Admin\AppData\Local\Temp\9631d8bd74d4a0384cae4396e9b0fa5f5898496028e24a274f3d571ce5c22b3a.exe"
                      1⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:1396
                      • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                        "C:\Users\Admin\AppData\Local\Temp\agdsk.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1432
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c taskkill /f /im chrome.exe
                          3⤵
                            PID:4808
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im chrome.exe
                              4⤵
                              • Kills process with taskkill
                              PID:4012
                        • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
                          "C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:2800
                        • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                          "C:\Users\Admin\AppData\Local\Temp\wf-game.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:3800
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" "C:\Program Files\patch.dll",patch
                            3⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3980
                        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                          "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4804
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1wNij7
                          2⤵
                          • Adds Run key to start application
                          • Enumerates system info in registry
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:2032
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffe844f46f8,0x7ffe844f4708,0x7ffe844f4718
                            3⤵
                              PID:2692
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                              3⤵
                                PID:856
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4156
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
                                3⤵
                                  PID:1108
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
                                  3⤵
                                    PID:2608
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
                                    3⤵
                                      PID:4264
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5340 /prefetch:8
                                      3⤵
                                        PID:3620
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
                                        3⤵
                                          PID:1984
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                                          3⤵
                                            PID:2296
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
                                            3⤵
                                              PID:2360
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:8
                                              3⤵
                                                PID:4072
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                                3⤵
                                                • Drops file in Program Files directory
                                                PID:4076
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x204,0x20c,0x100,0x22c,0x7ff6a7025460,0x7ff6a7025470,0x7ff6a7025480
                                                  4⤵
                                                    PID:4612
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6504 /prefetch:8
                                                  3⤵
                                                    PID:952
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6528 /prefetch:8
                                                    3⤵
                                                      PID:5324
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
                                                      3⤵
                                                        PID:5432
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2
                                                        3⤵
                                                          PID:5540
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2112,6577706079275321135,2875933425337646756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6760 /prefetch:8
                                                          3⤵
                                                            PID:5620
                                                        • C:\Users\Admin\AppData\Local\Temp\ujqb.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\ujqb.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Checks computer location settings
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4144
                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetThreadContext
                                                            PID:1488
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                              4⤵
                                                                PID:4752
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1jF6h7
                                                              3⤵
                                                                PID:404
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe844f46f8,0x7ffe844f4708,0x7ffe844f4718
                                                                  4⤵
                                                                    PID:1828
                                                              • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Checks SCSI registry key(s)
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious behavior: MapViewOfSection
                                                                PID:4844
                                                              • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Adds Run key to start application
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1252
                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:4776
                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1576
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:2204
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                1⤵
                                                                  PID:4808

                                                                Network

                                                                MITRE ATT&CK Matrix ATT&CK v6

                                                                Persistence

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1060

                                                                Defense Evasion

                                                                Modify Registry

                                                                1
                                                                T1112

                                                                Credential Access

                                                                Credentials in Files

                                                                1
                                                                T1081

                                                                Discovery

                                                                Query Registry

                                                                5
                                                                T1012

                                                                System Information Discovery

                                                                7
                                                                T1082

                                                                Peripheral Device Discovery

                                                                2
                                                                T1120

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Web Service

                                                                1
                                                                T1102

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Program Files\patch.dat
                                                                  MD5

                                                                  e0951976d9544f909a27f759bb3b7f85

                                                                  SHA1

                                                                  f85ab0b98b6b46d2c52a61ae57e6cc381049cd4a

                                                                  SHA256

                                                                  bb0c68cfd8555c4526f36a4a1aabff3ab9565cc1ca8535de1f99f6dcf60c6652

                                                                  SHA512

                                                                  023e61bd1ffab2e909e585a84f2c63fb4748ca118264ec6aac2335df1d286d84f2a97cc983a491af5834b07102951563d29613d2ecc71df1ca43c0e7554d9992

                                                                • C:\Program Files\patch.dll
                                                                  MD5

                                                                  75ca86f2b605a5924edeb57b180620e7

                                                                  SHA1

                                                                  df2fda930efd40c2ae7c59533e5097bd631c3b47

                                                                  SHA256

                                                                  00cb52b80d015d1b692158ce9ca867b99b1ac82d9538090a09881b9edaa0c417

                                                                  SHA512

                                                                  d68b04f03d719506c418daa65d601d55a9319b84d5c53d16430a484a24f78d1237d14168fbc5c94221bf18ed40302cff7a2f02b05f7a0c3b95e870356d2cd63c

                                                                • C:\Program Files\patch.dll
                                                                  MD5

                                                                  75ca86f2b605a5924edeb57b180620e7

                                                                  SHA1

                                                                  df2fda930efd40c2ae7c59533e5097bd631c3b47

                                                                  SHA256

                                                                  00cb52b80d015d1b692158ce9ca867b99b1ac82d9538090a09881b9edaa0c417

                                                                  SHA512

                                                                  d68b04f03d719506c418daa65d601d55a9319b84d5c53d16430a484a24f78d1237d14168fbc5c94221bf18ed40302cff7a2f02b05f7a0c3b95e870356d2cd63c

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                  MD5

                                                                  3b3ae2b28ae533bf89071e80738c60b3

                                                                  SHA1

                                                                  339000c34cbaeced8672524882a69c2e7d87a95d

                                                                  SHA256

                                                                  d8723fc8a20413de9be784f0903c3a1e663b482b6a192238aebc3c3fd096813a

                                                                  SHA512

                                                                  5eee26d2d12e9169816d9a14e00972f93e1c6272e6c3a427667a92ffe7bfb403bbbb2269aedba57969473b98bc807f2e5c7f52635d8ce54d03c62aa2bec7a6a6

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                  MD5

                                                                  e5e3377341056643b0494b6842c0b544

                                                                  SHA1

                                                                  d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                  SHA256

                                                                  e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                  SHA512

                                                                  83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                • C:\Users\Admin\AppData\Local\Temp\CC4F.tmp
                                                                  MD5

                                                                  4f3387277ccbd6d1f21ac5c07fe4ca68

                                                                  SHA1

                                                                  e16506f662dc92023bf82def1d621497c8ab5890

                                                                  SHA256

                                                                  767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

                                                                  SHA512

                                                                  9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

                                                                • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                  MD5

                                                                  95b8301688985fa56510fc92cfa6e1ca

                                                                  SHA1

                                                                  16d68a7f32b148f2d39197500b1b0c342d8561c1

                                                                  SHA256

                                                                  9a2fd341a2811c1ce5b3fa198c52a3e9f074c6338dff3be017fb53dcd9f0ca88

                                                                  SHA512

                                                                  f75c037492f2741ce639d4b5536843e3224a359495ae18e9b881496bf7b9e7d8cf68cd9c7083e41c2fba0227396c4f210b6fbea3265669323230506099341c45

                                                                • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                                                                  MD5

                                                                  95b8301688985fa56510fc92cfa6e1ca

                                                                  SHA1

                                                                  16d68a7f32b148f2d39197500b1b0c342d8561c1

                                                                  SHA256

                                                                  9a2fd341a2811c1ce5b3fa198c52a3e9f074c6338dff3be017fb53dcd9f0ca88

                                                                  SHA512

                                                                  f75c037492f2741ce639d4b5536843e3224a359495ae18e9b881496bf7b9e7d8cf68cd9c7083e41c2fba0227396c4f210b6fbea3265669323230506099341c45

                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                                                                  MD5

                                                                  954b39f45379c530b7f659d697c29ac7

                                                                  SHA1

                                                                  9fa7dcb754041cc878f6ca3a71581a04e3b23427

                                                                  SHA256

                                                                  301a510700f2ebccd25fc5cc6c579ead2196b957ed81aa3eda29c7bc40887c26

                                                                  SHA512

                                                                  aecda633e082d00a5d9989aad8e20e300372efdcdbe4f48991b7fb7f70079d7465f420c278167edf25656966c44ac03ab72c3f1aaa18962771bee63364e7a6d8

                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                                                                  MD5

                                                                  954b39f45379c530b7f659d697c29ac7

                                                                  SHA1

                                                                  9fa7dcb754041cc878f6ca3a71581a04e3b23427

                                                                  SHA256

                                                                  301a510700f2ebccd25fc5cc6c579ead2196b957ed81aa3eda29c7bc40887c26

                                                                  SHA512

                                                                  aecda633e082d00a5d9989aad8e20e300372efdcdbe4f48991b7fb7f70079d7465f420c278167edf25656966c44ac03ab72c3f1aaa18962771bee63364e7a6d8

                                                                • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                                                                  MD5

                                                                  618c39d0b0b20b2b5449ab2eae8e00a2

                                                                  SHA1

                                                                  8cb2c1556062e3352b24e7c05f32c65138cb71ac

                                                                  SHA256

                                                                  e8ba721c624ea94595a594790089702d36e024966bf2110bdf374ee2a292e375

                                                                  SHA512

                                                                  197a6e6e591d665f2b32ff7e4dd2fea5a1fa81f873d9295ed45617869a4802c24d2eb8c213f30a05b8739c609435493f7d672c5ba8362e009086294b1067555d

                                                                • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                                                                  MD5

                                                                  618c39d0b0b20b2b5449ab2eae8e00a2

                                                                  SHA1

                                                                  8cb2c1556062e3352b24e7c05f32c65138cb71ac

                                                                  SHA256

                                                                  e8ba721c624ea94595a594790089702d36e024966bf2110bdf374ee2a292e375

                                                                  SHA512

                                                                  197a6e6e591d665f2b32ff7e4dd2fea5a1fa81f873d9295ed45617869a4802c24d2eb8c213f30a05b8739c609435493f7d672c5ba8362e009086294b1067555d

                                                                • C:\Users\Admin\AppData\Local\Temp\edge_BITS_2032_1153481948\b22f5f18-f7ea-4290-929d-b13c03908334
                                                                  MD5

                                                                  a36d70bcd9333175811c53122f7d2c1d

                                                                  SHA1

                                                                  9a9a0c0ac2fc1db6e7b78868c8d4c96d747b8f1c

                                                                  SHA256

                                                                  26123bef7d73536450862d2c4d44963d720aa80b6fc2d8496f559cb9c1fdeb00

                                                                  SHA512

                                                                  e69aee2d91c50dd63030bd64cd12b5120c1db9871caf3c26b2cbf29ff96891b5f2e7d1388e4b731f77d7fb24904f379a6a8d5c1b2aacf8a8501fd0111ab0caf5

                                                                • C:\Users\Admin\AppData\Local\Temp\edge_BITS_2032_173867217\c502e396-3183-40d0-bc8b-e6f0d4fa22da
                                                                  MD5

                                                                  6c337c4eaac9b4685fbd6ee53785e190

                                                                  SHA1

                                                                  af6c2a5c97a4da837e1546083593b5002fd3a4fb

                                                                  SHA256

                                                                  ca3a4f89d6a3eb5632a2e6b0a6b0f375c0a45a8dcde57b16ca0a56b932794f50

                                                                  SHA512

                                                                  caf0ad840d12c44be60de1abfb72373e4eef263a397cb3cc3d7ed3e0bbb2da4a72674d137a02c10f71b352270a48fe287fd5a8972d26234fb0da10acd16b1e64

                                                                • C:\Users\Admin\AppData\Local\Temp\edge_BITS_2032_45023818\2132f61f-f790-4ae6-a355-8cf9a1533800
                                                                  MD5

                                                                  1a9c030cf025d340ff394cd9e5b664f3

                                                                  SHA1

                                                                  c1e8490662903d90de97760cb3102426f2784bd9

                                                                  SHA256

                                                                  a81d1959892ae4180554347df1b97834abba2e1a5e6b9aeba000ecea26eabecc

                                                                  SHA512

                                                                  7a9584c96849b1c8c623119bea4255a628e0f36d3a5f670e9c6a20f84d250fee859751a521322864b1577d7ca3ecdd7ee805c0f35bd7d74ddf43afc9f2abf8cb

                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  MD5

                                                                  519649607715e48c21a724bfc04b8343

                                                                  SHA1

                                                                  8f6816d7c8acf7badbfd9a9c6b457c2c8fec878d

                                                                  SHA256

                                                                  f523bd5e486fd5f9700ed3e443c157203cb5dd73865ab67ec8aa3610a965d13a

                                                                  SHA512

                                                                  8f53f03703088e05e2712bed507aec340030f09ccf8804e3483d154722026c6fac52d3beeffd49720700e5bff267e821774c6345493b0cfa8addd3b59ab55408

                                                                • C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                  MD5

                                                                  b7161c0845a64ff6d7345b67ff97f3b0

                                                                  SHA1

                                                                  d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

                                                                  SHA256

                                                                  fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

                                                                  SHA512

                                                                  98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  MD5

                                                                  a6279ec92ff948760ce53bba817d6a77

                                                                  SHA1

                                                                  5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                  SHA256

                                                                  8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                  SHA512

                                                                  213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  MD5

                                                                  a6279ec92ff948760ce53bba817d6a77

                                                                  SHA1

                                                                  5345505e12f9e4c6d569a226d50e71b5a572dce2

                                                                  SHA256

                                                                  8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

                                                                  SHA512

                                                                  213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  MD5

                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                  SHA1

                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                  SHA256

                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                  SHA512

                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                  MD5

                                                                  7fee8223d6e4f82d6cd115a28f0b6d58

                                                                  SHA1

                                                                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                                                                  SHA256

                                                                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                                                                  SHA512

                                                                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                                                                • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
                                                                  MD5

                                                                  338921a2482dbb47a0ac6ba265179316

                                                                  SHA1

                                                                  8ec2d631aa5a52b7aa1c4c62b788e8dd35e20f49

                                                                  SHA256

                                                                  90c97549326a337f150c97dc59b7cad89176773cd71851423c2f8ae80472f518

                                                                  SHA512

                                                                  42b5fc41392b14365250ee832cedd86be590128d9fdf459d1fc8727f818910c86439e63de1b492fd16d695bc915c4a74187191b6be2f59de7470d521984e8f77

                                                                • C:\Users\Admin\AppData\Local\Temp\jg4_4jaa.exe
                                                                  MD5

                                                                  338921a2482dbb47a0ac6ba265179316

                                                                  SHA1

                                                                  8ec2d631aa5a52b7aa1c4c62b788e8dd35e20f49

                                                                  SHA256

                                                                  90c97549326a337f150c97dc59b7cad89176773cd71851423c2f8ae80472f518

                                                                  SHA512

                                                                  42b5fc41392b14365250ee832cedd86be590128d9fdf459d1fc8727f818910c86439e63de1b492fd16d695bc915c4a74187191b6be2f59de7470d521984e8f77

                                                                • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                  MD5

                                                                  6de1d89a5d69b052ae3530531d515cbe

                                                                  SHA1

                                                                  7acbdfb192f867f9b6cd13bae14e1f10a392aee3

                                                                  SHA256

                                                                  324f039f77af286f88cfbde910884be2639ae4b1e3482d2bc7b715ca3473b673

                                                                  SHA512

                                                                  bd61de4aef4a3861cc04ab58342f3f32221534d07935a3941f9aa35efed47ba3870b9e8559ace9e8a454dc31f62e2f42de66ae284b691058bcd1c88e955f11ee

                                                                • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                                                                  MD5

                                                                  6de1d89a5d69b052ae3530531d515cbe

                                                                  SHA1

                                                                  7acbdfb192f867f9b6cd13bae14e1f10a392aee3

                                                                  SHA256

                                                                  324f039f77af286f88cfbde910884be2639ae4b1e3482d2bc7b715ca3473b673

                                                                  SHA512

                                                                  bd61de4aef4a3861cc04ab58342f3f32221534d07935a3941f9aa35efed47ba3870b9e8559ace9e8a454dc31f62e2f42de66ae284b691058bcd1c88e955f11ee

                                                                • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                  MD5

                                                                  8cbde3982249e20a6f564eb414f06fe4

                                                                  SHA1

                                                                  6d040b6c0f9d10b07f0b63797aa7bfabf0703925

                                                                  SHA256

                                                                  4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

                                                                  SHA512

                                                                  d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

                                                                • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                                                                  MD5

                                                                  8cbde3982249e20a6f564eb414f06fe4

                                                                  SHA1

                                                                  6d040b6c0f9d10b07f0b63797aa7bfabf0703925

                                                                  SHA256

                                                                  4a8a37d0010b2a946e9b202ea07d8b93a29a3ea9a56852678307076e10999c83

                                                                  SHA512

                                                                  d84863489b5fb2d17ee1df47de735a88d510bb8f5e378126243e34edb017d3ed82807c7dbd5cf6a977601f0e440be12e680679f1ce472619fd0ebbe9579c3e1b

                                                                • C:\Users\Admin\AppData\Local\Temp\ujqb.exe
                                                                  MD5

                                                                  c07b463cb3a46eecd4f560c13e27f3cd

                                                                  SHA1

                                                                  5d4bcd0532f83be709449e451148200b78c293b0

                                                                  SHA256

                                                                  07eb775d151d4430d83d61862054f7618e63ba4515466e06147d487d0ea8e4f5

                                                                  SHA512

                                                                  439f9259e3d5b6866b5c5b7b31d81b98079e2d119c7a2ac152c32cb0b598b763b7b3fe072b3634b6e10630c3b306ed172725b45f4d233527edfd8ad7411f41ba

                                                                • C:\Users\Admin\AppData\Local\Temp\ujqb.exe
                                                                  MD5

                                                                  c07b463cb3a46eecd4f560c13e27f3cd

                                                                  SHA1

                                                                  5d4bcd0532f83be709449e451148200b78c293b0

                                                                  SHA256

                                                                  07eb775d151d4430d83d61862054f7618e63ba4515466e06147d487d0ea8e4f5

                                                                  SHA512

                                                                  439f9259e3d5b6866b5c5b7b31d81b98079e2d119c7a2ac152c32cb0b598b763b7b3fe072b3634b6e10630c3b306ed172725b45f4d233527edfd8ad7411f41ba

                                                                • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                                                                  MD5

                                                                  5530c8bf2fddf2afc18b2defc14d3a74

                                                                  SHA1

                                                                  872b5a3d72b20f64fbe5e5ed1998ea749d0ef648

                                                                  SHA256

                                                                  6e052a1f2392408efc528e25591b417c14cb1ff6e96faa6ff26b61f61ebfca3c

                                                                  SHA512

                                                                  a388aa78aecb876d42823c2a06f10f873182eacd18c31ae52323014f635e13fab16b07b0752462ad02fd9cdbba47c269bbcf4dacb89be39f0352bc02ee09ae0b

                                                                • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                                                                  MD5

                                                                  5530c8bf2fddf2afc18b2defc14d3a74

                                                                  SHA1

                                                                  872b5a3d72b20f64fbe5e5ed1998ea749d0ef648

                                                                  SHA256

                                                                  6e052a1f2392408efc528e25591b417c14cb1ff6e96faa6ff26b61f61ebfca3c

                                                                  SHA512

                                                                  a388aa78aecb876d42823c2a06f10f873182eacd18c31ae52323014f635e13fab16b07b0752462ad02fd9cdbba47c269bbcf4dacb89be39f0352bc02ee09ae0b

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk
                                                                  MD5

                                                                  ba8595e1794b38b9265603e64d9ee0d9

                                                                  SHA1

                                                                  1980f9c536f403f4e99a1562bc3bae111d97821e

                                                                  SHA256

                                                                  3364eef59a3c371f8054c641a2f39dde0455d1f1f300591e8de75f680b09e6a9

                                                                  SHA512

                                                                  3b5a3fdd7b4b01886d14559850533fbef5aed44c8b57d3c0ab35cccfb6faf17f6f623477067ec8419f0c723845b8ee95eb9cbea18bb239883c58021e0a4842de

                                                                • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                  MD5

                                                                  a16d6dba3be753d61d5cc09cedc44e84

                                                                  SHA1

                                                                  c7978895d0134decf3b3694025578dbc04760169

                                                                  SHA256

                                                                  ecbc272ac462c196438bcdd6e9416b46282acdddca8b2579b880a5d3c866f5bd

                                                                  SHA512

                                                                  e0ed1fda17db2c109b9d4534efe939499c90398f62a384818452187a948ee7a45afc1a3a1817abb66cbfa5569d63186f97f3b8ec0401b1ca1a71bdec35d7f934

                                                                • \??\pipe\LOCAL\crashpad_2032_RNIDSBQHJQNICGNP
                                                                  MD5

                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                  SHA1

                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                  SHA256

                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                  SHA512

                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                • memory/388-154-0x000001DA33F90000-0x000001DA33FD4000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/388-155-0x000001DA345B0000-0x000001DA34617000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/856-193-0x00007FFEA06B0000-0x00007FFEA06B1000-memory.dmp
                                                                  Filesize

                                                                  4KB

                                                                • memory/1132-166-0x00000247DBB20000-0x00000247DBB87000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1132-165-0x00000247DBA60000-0x00000247DBAA4000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/1204-164-0x0000025C94880000-0x0000025C948E7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1204-163-0x0000025C940F0000-0x0000025C94134000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/1336-172-0x0000022B1DC00000-0x0000022B1DC67000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1372-170-0x0000026649F40000-0x0000026649FA7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1372-169-0x0000026649930000-0x0000026649974000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/1476-171-0x000002D261F20000-0x000002D261F87000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1488-183-0x0000000004AA0000-0x0000000004B32000-memory.dmp
                                                                  Filesize

                                                                  584KB

                                                                • memory/1488-195-0x0000000004B40000-0x00000000050E4000-memory.dmp
                                                                  Filesize

                                                                  5.6MB

                                                                • memory/1488-191-0x0000000004C80000-0x0000000004C8A000-memory.dmp
                                                                  Filesize

                                                                  40KB

                                                                • memory/1488-182-0x00000000000E0000-0x0000000000160000-memory.dmp
                                                                  Filesize

                                                                  512KB

                                                                • memory/1488-188-0x00000000050F0000-0x0000000005694000-memory.dmp
                                                                  Filesize

                                                                  5.6MB

                                                                • memory/1488-184-0x00000000717B0000-0x0000000071F60000-memory.dmp
                                                                  Filesize

                                                                  7.7MB

                                                                • memory/1616-168-0x000001D2CC740000-0x000001D2CC7A7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/1616-167-0x000001D2CC100000-0x000001D2CC144000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/2472-159-0x000001D155320000-0x000001D155387000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/2472-157-0x000001D155260000-0x000001D1552A4000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/2620-204-0x0000000008840000-0x0000000008856000-memory.dmp
                                                                  Filesize

                                                                  88KB

                                                                • memory/2680-161-0x000002D617F40000-0x000002D617F84000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/2680-162-0x000002D618540000-0x000002D6185A7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/2712-174-0x0000018429600000-0x0000018429667000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/2732-187-0x0000023CA5D00000-0x0000023CA5D44000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/2732-189-0x0000023CA6000000-0x0000023CA6067000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/2800-226-0x00000000041A0000-0x00000000041A8000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/2800-213-0x0000000003530000-0x0000000003540000-memory.dmp
                                                                  Filesize

                                                                  64KB

                                                                • memory/2800-238-0x0000000004390000-0x0000000004398000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/2800-225-0x0000000004180000-0x0000000004188000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/2800-219-0x00000000036D0000-0x00000000036E0000-memory.dmp
                                                                  Filesize

                                                                  64KB

                                                                • memory/2800-228-0x0000000004240000-0x0000000004248000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/2800-241-0x00000000041A0000-0x00000000041A8000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/2800-240-0x00000000041A0000-0x00000000041A8000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/2800-239-0x00000000043B0000-0x00000000043B8000-memory.dmp
                                                                  Filesize

                                                                  32KB

                                                                • memory/2812-158-0x000001CDC8EE0000-0x000001CDC8F24000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/2812-160-0x000001CDC92D0000-0x000001CDC9337000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/3496-185-0x000002B86B280000-0x000002B86B2C4000-memory.dmp
                                                                  Filesize

                                                                  272KB

                                                                • memory/3496-186-0x000002B86B340000-0x000002B86B3A7000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/3980-151-0x0000000002C70000-0x0000000002CC6000-memory.dmp
                                                                  Filesize

                                                                  344KB

                                                                • memory/3980-144-0x0000000002BE0000-0x0000000002C1A000-memory.dmp
                                                                  Filesize

                                                                  232KB

                                                                • memory/4752-236-0x0000000005A70000-0x0000000005B7A000-memory.dmp
                                                                  Filesize

                                                                  1.0MB

                                                                • memory/4752-229-0x0000000005CE0000-0x00000000062F8000-memory.dmp
                                                                  Filesize

                                                                  6.1MB

                                                                • memory/4752-230-0x00000000056C0000-0x00000000056D2000-memory.dmp
                                                                  Filesize

                                                                  72KB

                                                                • memory/4752-231-0x0000000005720000-0x000000000575C000-memory.dmp
                                                                  Filesize

                                                                  240KB

                                                                • memory/4752-233-0x00000000717B0000-0x0000000071F60000-memory.dmp
                                                                  Filesize

                                                                  7.7MB

                                                                • memory/4752-234-0x00000000056C0000-0x0000000005CD8000-memory.dmp
                                                                  Filesize

                                                                  6.1MB

                                                                • memory/4752-227-0x0000000000400000-0x000000000041C000-memory.dmp
                                                                  Filesize

                                                                  112KB

                                                                • memory/4804-138-0x0000000000D30000-0x0000000000D66000-memory.dmp
                                                                  Filesize

                                                                  216KB

                                                                • memory/4804-139-0x00007FFE82B80000-0x00007FFE83641000-memory.dmp
                                                                  Filesize

                                                                  10.8MB

                                                                • memory/4804-140-0x0000000001490000-0x0000000001492000-memory.dmp
                                                                  Filesize

                                                                  8KB

                                                                • memory/4844-175-0x0000000000C09000-0x0000000000C12000-memory.dmp
                                                                  Filesize

                                                                  36KB

                                                                • memory/4844-173-0x0000000000C09000-0x0000000000C12000-memory.dmp
                                                                  Filesize

                                                                  36KB

                                                                • memory/4844-177-0x0000000000B20000-0x0000000000B29000-memory.dmp
                                                                  Filesize

                                                                  36KB

                                                                • memory/4844-179-0x0000000000400000-0x0000000000A15000-memory.dmp
                                                                  Filesize

                                                                  6.1MB

                                                                • memory/5064-153-0x000001CABC800000-0x000001CABC867000-memory.dmp
                                                                  Filesize

                                                                  412KB

                                                                • memory/5064-152-0x000001CABC740000-0x000001CABC784000-memory.dmp
                                                                  Filesize

                                                                  272KB