Resubmissions

02-12-2022 16:07

221202-tkqjssge4v 10

02-12-2022 14:05

221202-rd1p3shf7w 8

02-12-2022 13:33

221202-qtte9scb96 10

Analysis

  • max time kernel
    1097s
  • max time network
    1092s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-12-2022 16:07

General

  • Target

    WP#5563.html

  • Size

    1.3MB

  • MD5

    95ed47cde1fb0eb6dacc8b4670ebb6b7

  • SHA1

    521c360dcaa32e3eff2f428b86f8addd4ab8be6b

  • SHA256

    e9aa4f42f9605ed58f0b2a834f661456338208afc9d5397c490c80f617359e52

  • SHA512

    134dd937ef7261413a69503305e250aab3e181821b507c5a4519854ebc2c0ce07d0bbea3f15f3996178e9b027aa4e9cbb8aba7e966d11f68db7264c6e2652998

  • SSDEEP

    24576:mJ2sDzVQSb1YgNQPBNbCmsJOGXwllO3gmpeV+3uYNYhtpVE:m8mNtlmSOZi7pt+/u

Malware Config

Extracted

Family

qakbot

Version

404.46

Botnet

obama224

Campaign

1669794048

C2

75.161.233.194:995

216.82.134.218:443

174.104.184.149:443

173.18.126.3:443

87.202.101.164:50000

172.90.139.138:2222

184.153.132.82:443

185.135.120.81:443

24.228.132.224:2222

87.223.84.190:443

178.153.195.40:443

24.64.114.59:2222

77.126.81.208:443

75.99.125.235:2222

173.239.94.212:443

98.145.23.67:443

109.177.245.176:2222

72.200.109.104:443

12.172.173.82:993

82.11.242.219:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 44 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Users\Admin\AppData\Local\Temp\WP#5563.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa9ca24f50,0x7ffa9ca24f60,0x7ffa9ca24f70
      2⤵
        PID:2780
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1700 /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5068
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1640 /prefetch:2
        2⤵
          PID:5060
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 /prefetch:8
          2⤵
            PID:3908
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2692 /prefetch:1
            2⤵
              PID:4604
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2628 /prefetch:1
              2⤵
                PID:2568
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4092 /prefetch:8
                2⤵
                  PID:2592
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4560
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
                  2⤵
                    PID:4100
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4540 /prefetch:8
                    2⤵
                      PID:4492
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5112
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4176
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5200 /prefetch:8
                      2⤵
                        PID:4692
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:8
                        2⤵
                          PID:3212
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4760 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3952
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3992
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4004
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5060 /prefetch:8
                          2⤵
                            PID:3896
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4552 /prefetch:8
                            2⤵
                              PID:4724
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4740 /prefetch:8
                              2⤵
                                PID:4864
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5044 /prefetch:8
                                2⤵
                                  PID:4824
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                                  2⤵
                                    PID:1100
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5052 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:68
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5104 /prefetch:8
                                    2⤵
                                      PID:3696
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:1
                                      2⤵
                                        PID:3128
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1556 /prefetch:1
                                        2⤵
                                          PID:4156
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:8
                                          2⤵
                                            PID:1604
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5972 /prefetch:8
                                            2⤵
                                              PID:388
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5968 /prefetch:8
                                              2⤵
                                                PID:2692
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5960 /prefetch:8
                                                2⤵
                                                  PID:3236
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5852 /prefetch:8
                                                  2⤵
                                                    PID:3264
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5932 /prefetch:8
                                                    2⤵
                                                      PID:4588
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
                                                      2⤵
                                                        PID:2204
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
                                                        2⤵
                                                          PID:4864
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                                                          2⤵
                                                            PID:4616
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
                                                            2⤵
                                                              PID:2296
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1732 /prefetch:8
                                                              2⤵
                                                                PID:1040
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2400 /prefetch:8
                                                                2⤵
                                                                  PID:1740
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
                                                                  2⤵
                                                                    PID:3952
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5736 /prefetch:8
                                                                    2⤵
                                                                      PID:2228
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
                                                                      2⤵
                                                                        PID:1808
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1628,13443464914330391645,7881150001469153313,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4864 /prefetch:8
                                                                        2⤵
                                                                          PID:3488
                                                                      • C:\Windows\System32\rundll32.exe
                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                        1⤵
                                                                          PID:588
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                          1⤵
                                                                          • Checks SCSI registry key(s)
                                                                          • Modifies data under HKEY_USERS
                                                                          PID:3400
                                                                        • C:\Windows\System32\WScript.exe
                                                                          "C:\Windows\System32\WScript.exe" "E:\WP.vbs"
                                                                          1⤵
                                                                          • Enumerates connected drives
                                                                          PID:3156
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass metaphysic\\environmentalists.ps1
                                                                            2⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:748
                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                              "C:\Windows\system32\rundll32.exe" C:\users\public\untroubledlyHousetop.txt DrawThemeIcon
                                                                              3⤵
                                                                              • Loads dropped DLL
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              PID:4532
                                                                              • C:\Windows\SysWOW64\wermgr.exe
                                                                                C:\Windows\SysWOW64\wermgr.exe
                                                                                4⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:4288
                                                                        • C:\Windows\System32\Notepad.exe
                                                                          "C:\Windows\System32\Notepad.exe" E:\WP.vbs
                                                                          1⤵
                                                                            PID:2656
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4692
                                                                          • C:\Windows\system32\browser_broker.exe
                                                                            C:\Windows\system32\browser_broker.exe -Embedding
                                                                            1⤵
                                                                            • Modifies Internet Explorer settings
                                                                            PID:4300
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1892
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1136
                                                                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Modifies Internet Explorer settings
                                                                            • Modifies registry class
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2104
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
                                                                            1⤵
                                                                            • Drops file in Program Files directory
                                                                            PID:508
                                                                            • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir508_1152959119\ChromeRecovery.exe
                                                                              "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir508_1152959119\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={d46e56c4-5203-43fb-8581-f19f16aee746} --system
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:3736
                                                                          • C:\Windows\system32\NOTEPAD.EXE
                                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\untroubledlyHousetop.txt
                                                                            1⤵
                                                                            • Opens file in notepad (likely ransom note)
                                                                            PID:868
                                                                          • C:\Windows\System32\Notepad.exe
                                                                            "C:\Windows\System32\Notepad.exe" E:\WP.vbs
                                                                            1⤵
                                                                              PID:1136
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
                                                                              1⤵
                                                                              • Drops file in System32 directory
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3932
                                                                            • C:\Windows\system32\NOTEPAD.EXE
                                                                              "C:\Windows\system32\NOTEPAD.EXE" E:\metaphysic\readme.txt
                                                                              1⤵
                                                                                PID:3896
                                                                              • C:\Windows\system32\NOTEPAD.EXE
                                                                                "C:\Windows\system32\NOTEPAD.EXE" E:\metaphysic\choked.txt
                                                                                1⤵
                                                                                  PID:220
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe" "E:\metaphysic\environmentalists.ps1"
                                                                                  1⤵
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:4984
                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                  "C:\Windows\system32\NOTEPAD.EXE" E:\metaphysic\preyed.txt
                                                                                  1⤵
                                                                                    PID:3096
                                                                                  • C:\Windows\system32\mspaint.exe
                                                                                    "C:\Windows\system32\mspaint.exe" "E:\metaphysic\simmers.jpg" /ForceBootstrapPaint3D
                                                                                    1⤵
                                                                                    • Enumerates connected drives
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4476
                                                                                  • C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
                                                                                    "C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
                                                                                    1⤵
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4036
                                                                                    • C:\Windows\system32\WerFault.exe
                                                                                      C:\Windows\system32\WerFault.exe -u -p 4036 -s 3564
                                                                                      2⤵
                                                                                      • Program crash
                                                                                      PID:2824

                                                                                  Network

                                                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                                                  Defense Evasion

                                                                                  Modify Registry

                                                                                  1
                                                                                  T1112

                                                                                  Discovery

                                                                                  Query Registry

                                                                                  3
                                                                                  T1012

                                                                                  Peripheral Device Discovery

                                                                                  2
                                                                                  T1120

                                                                                  System Information Discovery

                                                                                  4
                                                                                  T1082

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir508_1152959119\ChromeRecovery.exe
                                                                                    Filesize

                                                                                    253KB

                                                                                    MD5

                                                                                    49ac3c96d270702a27b4895e4ce1f42a

                                                                                    SHA1

                                                                                    55b90405f1e1b72143c64113e8bc65608dd3fd76

                                                                                    SHA256

                                                                                    82aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f

                                                                                    SHA512

                                                                                    b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0

                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3
                                                                                    Filesize

                                                                                    141KB

                                                                                    MD5

                                                                                    ea1c1ffd3ea54d1fb117bfdbb3569c60

                                                                                    SHA1

                                                                                    10958b0f690ae8f5240e1528b1ccffff28a33272

                                                                                    SHA256

                                                                                    7c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d

                                                                                    SHA512

                                                                                    6c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                    Filesize

                                                                                    2KB

                                                                                    MD5

                                                                                    6bf0e5945fb9da68e1b03bdaed5f6f8d

                                                                                    SHA1

                                                                                    eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

                                                                                    SHA256

                                                                                    dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

                                                                                    SHA512

                                                                                    977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                    Filesize

                                                                                    45KB

                                                                                    MD5

                                                                                    0b5d94d20be9eecbaed3dddd04143f07

                                                                                    SHA1

                                                                                    c677d0355f4cc7301075a554adc889bce502e15a

                                                                                    SHA256

                                                                                    3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

                                                                                    SHA512

                                                                                    395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

                                                                                  • C:\Users\Public\untroubledlyHousetop.txt
                                                                                    Filesize

                                                                                    4KB

                                                                                    MD5

                                                                                    d7ad78ef183912c14f835f495eb23edf

                                                                                    SHA1

                                                                                    b8993dee6ef7dcf32af033506b599bcccb6cfd1c

                                                                                    SHA256

                                                                                    c3255453a92d467275698153ce1991d1bb598429040e2871ecfb871d915c62e3

                                                                                    SHA512

                                                                                    02e17eda487db734f55906d9b0f254c0d0238cdcae11dcb3ffc52fd5638def040a372d065899c8b3c67b988d5e26f6f1c5a2eec81429b7bd29421dbaa45a2bed

                                                                                  • C:\users\public\untroubledlyHousetop.txt
                                                                                    Filesize

                                                                                    577KB

                                                                                    MD5

                                                                                    0125f1347902aa693cebd76d9c4c0616

                                                                                    SHA1

                                                                                    679f4ea4b00b8940a8cbe222dc0d5f2d58a361b3

                                                                                    SHA256

                                                                                    bc09025357744618728ca95b83e281847d749d3dbbfd3118674c901079735c7d

                                                                                    SHA512

                                                                                    3f34ff6685f5c2d088aeb315217c6104acd0c507790e7891e2657b99eb0e4a22bc702bfae5b9bef7e5fc2cdb6e759e32c1270bf0e082e45baa9e8eabfed4099c

                                                                                  • \??\pipe\crashpad_2500_HLSQUPMDPXUWLGBR
                                                                                    MD5

                                                                                    d41d8cd98f00b204e9800998ecf8427e

                                                                                    SHA1

                                                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                    SHA256

                                                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                    SHA512

                                                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                  • \Users\Public\untroubledlyHousetop.txt
                                                                                    Filesize

                                                                                    577KB

                                                                                    MD5

                                                                                    0125f1347902aa693cebd76d9c4c0616

                                                                                    SHA1

                                                                                    679f4ea4b00b8940a8cbe222dc0d5f2d58a361b3

                                                                                    SHA256

                                                                                    bc09025357744618728ca95b83e281847d749d3dbbfd3118674c901079735c7d

                                                                                    SHA512

                                                                                    3f34ff6685f5c2d088aeb315217c6104acd0c507790e7891e2657b99eb0e4a22bc702bfae5b9bef7e5fc2cdb6e759e32c1270bf0e082e45baa9e8eabfed4099c

                                                                                  • memory/748-145-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-166-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-125-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-126-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-127-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-128-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-129-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-130-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-131-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-133-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-134-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-132-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-135-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-136-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-137-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-138-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-139-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-140-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-141-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-142-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-143-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-144-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-123-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-146-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-148-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-149-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-151-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-152-0x0000000005030000-0x0000000005066000-memory.dmp
                                                                                    Filesize

                                                                                    216KB

                                                                                  • memory/748-153-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-154-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-155-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-156-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-157-0x0000000007B90000-0x00000000081B8000-memory.dmp
                                                                                    Filesize

                                                                                    6.2MB

                                                                                  • memory/748-158-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-159-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-160-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-161-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-162-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-163-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-164-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-165-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-183-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-167-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-168-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-169-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-116-0x0000000000000000-mapping.dmp
                                                                                  • memory/748-181-0x0000000008740000-0x0000000008A90000-memory.dmp
                                                                                    Filesize

                                                                                    3.3MB

                                                                                  • memory/748-172-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-173-0x0000000008540000-0x0000000008562000-memory.dmp
                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/748-174-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-175-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-176-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-177-0x00000000085E0000-0x0000000008646000-memory.dmp
                                                                                    Filesize

                                                                                    408KB

                                                                                  • memory/748-178-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-179-0x0000000008650000-0x00000000086B6000-memory.dmp
                                                                                    Filesize

                                                                                    408KB

                                                                                  • memory/748-180-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-117-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-185-0x0000000008DE0000-0x0000000008E2B000-memory.dmp
                                                                                    Filesize

                                                                                    300KB

                                                                                  • memory/748-124-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-184-0x0000000008DA0000-0x0000000008DBC000-memory.dmp
                                                                                    Filesize

                                                                                    112KB

                                                                                  • memory/748-182-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-186-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-187-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-188-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-189-0x0000000009060000-0x00000000090D6000-memory.dmp
                                                                                    Filesize

                                                                                    472KB

                                                                                  • memory/748-190-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-191-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-202-0x000000000A150000-0x000000000A1E4000-memory.dmp
                                                                                    Filesize

                                                                                    592KB

                                                                                  • memory/748-203-0x00000000034B0000-0x00000000034CA000-memory.dmp
                                                                                    Filesize

                                                                                    104KB

                                                                                  • memory/748-204-0x0000000009390000-0x00000000093B2000-memory.dmp
                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/748-205-0x000000000A6F0000-0x000000000ABEE000-memory.dmp
                                                                                    Filesize

                                                                                    5.0MB

                                                                                  • memory/748-118-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-122-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-121-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-119-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/748-120-0x00000000777D0000-0x000000007795E000-memory.dmp
                                                                                    Filesize

                                                                                    1.6MB

                                                                                  • memory/3736-359-0x0000000000000000-mapping.dmp
                                                                                  • memory/3932-546-0x0000000007570000-0x00000000078C0000-memory.dmp
                                                                                    Filesize

                                                                                    3.3MB

                                                                                  • memory/3932-619-0x00000000098D0000-0x0000000009975000-memory.dmp
                                                                                    Filesize

                                                                                    660KB

                                                                                  • memory/3932-614-0x0000000009870000-0x000000000988E000-memory.dmp
                                                                                    Filesize

                                                                                    120KB

                                                                                  • memory/3932-613-0x0000000009890000-0x00000000098C3000-memory.dmp
                                                                                    Filesize

                                                                                    204KB

                                                                                  • memory/3932-825-0x0000000009A40000-0x0000000009A5A000-memory.dmp
                                                                                    Filesize

                                                                                    104KB

                                                                                  • memory/3932-830-0x0000000009A30000-0x0000000009A38000-memory.dmp
                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/3932-566-0x0000000008B30000-0x0000000008B6C000-memory.dmp
                                                                                    Filesize

                                                                                    240KB

                                                                                  • memory/3932-549-0x0000000007E70000-0x0000000007EBB000-memory.dmp
                                                                                    Filesize

                                                                                    300KB

                                                                                  • memory/4288-355-0x0000000002E70000-0x0000000002E9A000-memory.dmp
                                                                                    Filesize

                                                                                    168KB

                                                                                  • memory/4288-342-0x0000000002E70000-0x0000000002E9A000-memory.dmp
                                                                                    Filesize

                                                                                    168KB

                                                                                  • memory/4288-296-0x0000000000000000-mapping.dmp
                                                                                  • memory/4532-234-0x0000000000000000-mapping.dmp
                                                                                  • memory/4532-293-0x00000000030D0000-0x00000000030FD000-memory.dmp
                                                                                    Filesize

                                                                                    180KB

                                                                                  • memory/4532-338-0x0000000003100000-0x000000000312A000-memory.dmp
                                                                                    Filesize

                                                                                    168KB

                                                                                  • memory/4532-294-0x0000000003100000-0x000000000312A000-memory.dmp
                                                                                    Filesize

                                                                                    168KB

                                                                                  • memory/4532-295-0x0000000003100000-0x000000000312A000-memory.dmp
                                                                                    Filesize

                                                                                    168KB

                                                                                  • memory/4692-171-0x000001A668600000-0x000001A668610000-memory.dmp
                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/4692-170-0x000001A667D20000-0x000001A667D30000-memory.dmp
                                                                                    Filesize

                                                                                    64KB

                                                                                  • memory/4984-867-0x000001B561D40000-0x000001B561D48000-memory.dmp
                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4984-853-0x000001B55FB10000-0x000001B55FB5A000-memory.dmp
                                                                                    Filesize

                                                                                    296KB

                                                                                  • memory/4984-855-0x000001B55FB60000-0x000001B55FB98000-memory.dmp
                                                                                    Filesize

                                                                                    224KB

                                                                                  • memory/4984-856-0x000001B55FAD0000-0x000001B55FAD8000-memory.dmp
                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4984-857-0x000001B561A00000-0x000001B561A22000-memory.dmp
                                                                                    Filesize

                                                                                    136KB

                                                                                  • memory/4984-858-0x000001B561AB0000-0x000001B561B26000-memory.dmp
                                                                                    Filesize

                                                                                    472KB

                                                                                  • memory/4984-859-0x000001B55FBC0000-0x000001B55FBC8000-memory.dmp
                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4984-860-0x000001B55FBD0000-0x000001B55FBD8000-memory.dmp
                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4984-861-0x000001B561C00000-0x000001B561C08000-memory.dmp
                                                                                    Filesize

                                                                                    32KB

                                                                                  • memory/4984-854-0x000001B55F9A0000-0x000001B55F9AE000-memory.dmp
                                                                                    Filesize

                                                                                    56KB

                                                                                  • memory/4984-863-0x000001B561D20000-0x000001B561D3C000-memory.dmp
                                                                                    Filesize

                                                                                    112KB

                                                                                  • memory/4984-864-0x000001B561DE0000-0x000001B561E99000-memory.dmp
                                                                                    Filesize

                                                                                    740KB

                                                                                  • memory/4984-865-0x000001B561D20000-0x000001B561D2A000-memory.dmp
                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/4984-866-0x000001B561D40000-0x000001B561D5C000-memory.dmp
                                                                                    Filesize

                                                                                    112KB

                                                                                  • memory/4984-852-0x000001B543260000-0x000001B543298000-memory.dmp
                                                                                    Filesize

                                                                                    224KB

                                                                                  • memory/4984-868-0x000001B561EC0000-0x000001B561EDA000-memory.dmp
                                                                                    Filesize

                                                                                    104KB

                                                                                  • memory/4984-869-0x000001B561EC0000-0x000001B561EC6000-memory.dmp
                                                                                    Filesize

                                                                                    24KB

                                                                                  • memory/4984-870-0x000001B561ED0000-0x000001B561EDA000-memory.dmp
                                                                                    Filesize

                                                                                    40KB

                                                                                  • memory/4984-873-0x000001B561EE0000-0x000001B561EF2000-memory.dmp
                                                                                    Filesize

                                                                                    72KB

                                                                                  • memory/4984-874-0x000001B564EF0000-0x000001B564F2E000-memory.dmp
                                                                                    Filesize

                                                                                    248KB