Overview

overview

10

Static

static

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺ�...�ฺ1m

windows10_x64

10

ฺฺฺK...ฺฺ

windows7_x64

10

Resubmissions

18-11-2020 06:33

201118-kp3zay4l8x 10

17-11-2020 14:23

201117-x4r9kx1cm2 10

17-11-2020 12:54

201117-2kn67e3lma 10

17-11-2020 11:51

201117-b3wmz3vflx 10

17-11-2020 05:56

201117-59lqra7tjj 10

16-11-2020 19:43

201116-cnkkc8tqbj 10

16-11-2020 19:34

201116-6lrkrq9qle 10

Analysis

  • max time kernel
    392s
  • max time network
    1799s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17-11-2020 12:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.bin.exe

  • Size

    12.5MB

  • MD5

    af8e86c5d4198549f6375df9378f983c

  • SHA1

    7ab5ed449b891bd4899fba62d027a2cc26a05e6f

  • SHA256

    7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267

  • SHA512

    137f5a281aa15802e300872fdf93b9ee014d2077c29d30e5a029664eb0991af2afbe1e5c53a9d7bff8f0508393a8b7641c5a97b4b0e0061befb79a93506c94e1

Score
10/10
agenttesladanabotdharmaformbookqakbotwarzoneratspx1291590734339agilenetbankerbotnetcoreentitycryptoneevasioninfostealerkeyloggerpackerpersistenceransomwareratrezer0spywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    chukwudi123

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.zoho.eu
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    admin1ABC223@##!con

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.yandex.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    335410

Extracted

Family

formbook

C2

http://www.worstig.com/w9z/

http://www.norjax.com/app/

http://www.joomlas123.com/i0qi/
Decoy

crazzysex.com

hanferd.com

gteesrd.com

bayfrontbabyplace.com

jicuiquan.net

relationshiplink.net

ohchacyberphoto.com

kauegimenes.com

powerful-seldom.com

ketotoken.com

make-money-online-success.com

redgoldcollection.com

hannan-football.com

hamptondc.com

vllii.com

aa8520.com

platform35markethall.com

larozeimmo.com

oligopoly.net

llhak.info

Extracted

Family

danabot

C2

92.204.160.54

2.56.213.179

45.153.186.47

93.115.21.29

185.45.193.50

193.34.166.247
rsa_pubkey.plain

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta

Ransom Note
YOUR FILES ARE ENCRYPTED Don't worry,you can return all your files! If you want to restore them, follow this link: email [email protected] YOUR ID If you have not been answered via the link within 12 hours, write to us by e-mail: [email protected] Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Extracted

Family

qakbot

Botnet

spx129

Campaign

1590734339

C2

94.10.81.239:443

94.52.160.116:443

67.0.74.119:443

175.137.136.79:443

73.232.165.200:995

79.119.67.149:443

62.38.111.70:2222

108.58.9.238:993

216.110.249.252:2222

67.209.195.198:3389

84.247.55.190:443

96.37.137.42:443

94.176.220.76:2222

173.245.152.231:443

96.227.122.123:443

188.192.75.8:995

24.229.245.124:995

71.163.225.75:443

75.71.77.59:443

104.36.135.227:443

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity
  • Danabot

    Danabot is a modular banking Trojan that has been linked with other malware.

    trojanbankerdanabot
  • Danabot x86 payload 7 IoCs

    Detection of Danabot x86 payload, mapped in memory during the execution of its loader.

    botnet
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • AgentTesla Payload 29 IoCs
    keyloggerstealer
  • CryptOne packer 12 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Formbook Payload 28 IoCs
    rat
  • Looks for VirtualBox Guest Additions in registry 2 TTPs
    evasion
  • ServiceHost packer 13 IoCs

    Detects ServiceHost packer used for .NET malware

  • rezer0 3 IoCs

    Detects ReZer0, a packer with multiple versions used in various campaigns.

    rezer0
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Blacklisted process makes network request 20 IoCs
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 2 IoCs
  • Executes dropped EXE 48 IoCs
  • Looks for VMWare Tools registry key 2 TTPs
    evasion
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 6 IoCs
  • Loads dropped DLL 8 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spyware
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 14 IoCs
    persistence
  • Drops desktop.ini file(s) 71 IoCs
  • Maps connected drives based on registry 3 TTPs 8 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 2 IoCs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
  • Suspicious use of SetThreadContext 34 IoCs
  • Drops file in Program Files directory 35298 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1533 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 53 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 209 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 309 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops desktop.ini file(s)
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\1.bin.exe
      "C:\Users\Admin\AppData\Local\Temp\1.bin.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:412
      • C:\Windows\System32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6EEC.tmp\6EFD.tmp\6EFE.bat C:\Users\Admin\AppData\Local\Temp\1.bin.exe"
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe
          "C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"
          4⤵
            PID:660
          • C:\Users\Admin\AppData\Roaming\2.exe
            C:\Users\Admin\AppData\Roaming\2.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:196
            • C:\Users\Admin\AppData\Roaming\2.exe
              C:\Users\Admin\AppData\Roaming\2.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:2416
          • C:\Users\Admin\AppData\Roaming\3.exe
            C:\Users\Admin\AppData\Roaming\3.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:732
            • C:\Users\Admin\AppData\Roaming\3.exe
              C:\Users\Admin\AppData\Roaming\3.exe
              5⤵
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:3564
          • C:\Users\Admin\AppData\Roaming\4.exe
            C:\Users\Admin\AppData\Roaming\4.exe
            4⤵
            • Executes dropped EXE
            PID:3824
            • C:\Windows\SysWOW64\regsvr32.exe
              C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@3824
              5⤵
              • Loads dropped DLL
              PID:5088
              • C:\Windows\SysWOW64\rundll32.exe
                C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f0
                6⤵
                • Blacklisted process makes network request
                • Loads dropped DLL
                PID:3780
          • C:\Users\Admin\AppData\Roaming\5.exe
            C:\Users\Admin\AppData\Roaming\5.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:3688
          • C:\Users\Admin\AppData\Roaming\6.exe
            C:\Users\Admin\AppData\Roaming\6.exe
            4⤵
            • Executes dropped EXE
            PID:3424
          • C:\Users\Admin\AppData\Roaming\7.exe
            C:\Users\Admin\AppData\Roaming\7.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetWindowsHookEx
            PID:504
          • C:\Users\Admin\AppData\Roaming\8.exe
            C:\Users\Admin\AppData\Roaming\8.exe
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3812
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
              5⤵
                PID:3892
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"
                  6⤵
                  • Adds Run key to start application
                  PID:4360
              • C:\Users\Admin\AppData\Roaming\feeed.exe
                "C:\Users\Admin\AppData\Roaming\feeed.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:4936
                • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                  "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4584
                  • C:\Windows\SysWOW64\netsh.exe
                    "netsh" wlan show profile
                    7⤵
                      PID:4300
              • C:\Users\Admin\AppData\Roaming\9.exe
                C:\Users\Admin\AppData\Roaming\9.exe
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:192
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp276E.tmp"
                  5⤵
                  • Creates scheduled task(s)
                  PID:4740
                • C:\Users\Admin\AppData\Roaming\9.exe
                  "{path}"
                  5⤵
                  • Executes dropped EXE
                  PID:4120
                • C:\Users\Admin\AppData\Roaming\9.exe
                  "{path}"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4276
                  • C:\Windows\SysWOW64\netsh.exe
                    "netsh" wlan show profile
                    6⤵
                      PID:4540
                • C:\Users\Admin\AppData\Roaming\10.exe
                  C:\Users\Admin\AppData\Roaming\10.exe
                  4⤵
                  • Executes dropped EXE
                  PID:200
                • C:\Users\Admin\AppData\Roaming\11.exe
                  C:\Users\Admin\AppData\Roaming\11.exe
                  4⤵
                  • Executes dropped EXE
                  • Checks BIOS information in registry
                  • Maps connected drives based on registry
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2064
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5DF.tmp"
                    5⤵
                    • Creates scheduled task(s)
                    PID:4508
                  • C:\Users\Admin\AppData\Roaming\11.exe
                    "{path}"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4840
                • C:\Users\Admin\AppData\Roaming\12.exe
                  C:\Users\Admin\AppData\Roaming\12.exe
                  4⤵
                  • Executes dropped EXE
                  PID:772
                • C:\Users\Admin\AppData\Roaming\13.exe
                  C:\Users\Admin\AppData\Roaming\13.exe
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetWindowsHookEx
                  PID:2172
                  • C:\Users\Admin\AppData\Roaming\13.exe
                    C:\Users\Admin\AppData\Roaming\13.exe
                    5⤵
                    • Loads dropped DLL
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    PID:2420
                    • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
                      "C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"
                      6⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetWindowsHookEx
                      PID:4808
                      • C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe
                        "C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"
                        7⤵
                        • Loads dropped DLL
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:4800
                • C:\Users\Admin\AppData\Roaming\14.exe
                  C:\Users\Admin\AppData\Roaming\14.exe
                  4⤵
                  • Executes dropped EXE
                  PID:3904
                • C:\Users\Admin\AppData\Roaming\15.exe
                  C:\Users\Admin\AppData\Roaming\15.exe
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetWindowsHookEx
                  PID:2460
                • C:\Users\Admin\AppData\Roaming\16.exe
                  C:\Users\Admin\AppData\Roaming\16.exe
                  4⤵
                  • Executes dropped EXE
                  • Modifies extensions of user files
                  • Drops startup file
                  • Adds Run key to start application
                  • Drops desktop.ini file(s)
                  • Drops file in System32 directory
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: RenamesItself
                  PID:4072
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe"
                    5⤵
                      PID:4112
                      • C:\Windows\system32\mode.com
                        mode con cp select=1251
                        6⤵
                          PID:4572
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin delete shadows /all /quiet
                          6⤵
                          • Interacts with shadow copies
                          PID:4860
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe"
                        5⤵
                          PID:4668
                          • C:\Windows\system32\mode.com
                            mode con cp select=1251
                            6⤵
                              PID:2080
                            • C:\Windows\system32\vssadmin.exe
                              vssadmin delete shadows /all /quiet
                              6⤵
                              • Interacts with shadow copies
                              PID:2704
                          • C:\Windows\System32\mshta.exe
                            "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                            5⤵
                              PID:496
                            • C:\Windows\System32\mshta.exe
                              "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                              5⤵
                                PID:1648
                            • C:\Users\Admin\AppData\Roaming\17.exe
                              C:\Users\Admin\AppData\Roaming\17.exe
                              4⤵
                              • Executes dropped EXE
                              PID:4308
                            • C:\Users\Admin\AppData\Roaming\18.exe
                              C:\Users\Admin\AppData\Roaming\18.exe
                              4⤵
                              • Executes dropped EXE
                              • Maps connected drives based on registry
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4404
                            • C:\Users\Admin\AppData\Roaming\19.exe
                              C:\Users\Admin\AppData\Roaming\19.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of SetWindowsHookEx
                              PID:4608
                            • C:\Users\Admin\AppData\Roaming\20.exe
                              C:\Users\Admin\AppData\Roaming\20.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of SetWindowsHookEx
                              PID:4752
                            • C:\Users\Admin\AppData\Roaming\21.exe
                              C:\Users\Admin\AppData\Roaming\21.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:5012
                              • C:\Users\Admin\AppData\Roaming\21.exe
                                "{path}"
                                5⤵
                                • Executes dropped EXE
                                PID:3496
                            • C:\Users\Admin\AppData\Roaming\22.exe
                              C:\Users\Admin\AppData\Roaming\22.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4416
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                5⤵
                                • Suspicious behavior: GetForegroundWindowSpam
                                PID:416
                            • C:\Users\Admin\AppData\Roaming\23.exe
                              C:\Users\Admin\AppData\Roaming\23.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of SetWindowsHookEx
                              PID:4824
                            • C:\Users\Admin\AppData\Roaming\24.exe
                              C:\Users\Admin\AppData\Roaming\24.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:4956
                              • C:\Users\Admin\AppData\Roaming\24.exe
                                "{path}"
                                5⤵
                                • Drops file in Drivers directory
                                • Executes dropped EXE
                                PID:4264
                                • C:\Windows\SysWOW64\netsh.exe
                                  "netsh" wlan show profile
                                  6⤵
                                    PID:2200
                              • C:\Users\Admin\AppData\Roaming\25.exe
                                C:\Users\Admin\AppData\Roaming\25.exe
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious use of SetWindowsHookEx
                                PID:1256
                              • C:\Users\Admin\AppData\Roaming\26.exe
                                C:\Users\Admin\AppData\Roaming\26.exe
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:1892
                                • C:\Windows\SysWOW64\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA65E.tmp"
                                  5⤵
                                  • Creates scheduled task(s)
                                  PID:4104
                                • C:\Users\Admin\AppData\Roaming\26.exe
                                  "{path}"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:4916
                              • C:\Users\Admin\AppData\Roaming\27.exe
                                C:\Users\Admin\AppData\Roaming\27.exe
                                4⤵
                                • Executes dropped EXE
                                PID:2692
                                • C:\Users\Admin\AppData\Roaming\27.exe
                                  C:\Users\Admin\AppData\Roaming\27.exe /C
                                  5⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  PID:4332
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Damalotdbrhz\lyuyjb.exe
                                  C:\Users\Admin\AppData\Roaming\Microsoft\Damalotdbrhz\lyuyjb.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious behavior: MapViewOfSection
                                  PID:4856
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Damalotdbrhz\lyuyjb.exe
                                    C:\Users\Admin\AppData\Roaming\Microsoft\Damalotdbrhz\lyuyjb.exe /C
                                    6⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    PID:4288
                                  • C:\Windows\SysWOW64\explorer.exe
                                    C:\Windows\SysWOW64\explorer.exe
                                    6⤵
                                      PID:2480
                                    • C:\Windows\SysWOW64\explorer.exe
                                      C:\Windows\SysWOW64\explorer.exe
                                      6⤵
                                        PID:4356
                                      • C:\Windows\SysWOW64\mobsync.exe
                                        C:\Windows\SysWOW64\mobsync.exe
                                        6⤵
                                          PID:2544
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn flibpnt /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I flibpnt" /SC ONCE /Z /ST 14:02 /ET 14:14
                                        5⤵
                                        • Creates scheduled task(s)
                                        PID:4376
                                    • C:\Users\Admin\AppData\Roaming\28.exe
                                      C:\Users\Admin\AppData\Roaming\28.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1320
                                    • C:\Users\Admin\AppData\Roaming\29.exe
                                      C:\Users\Admin\AppData\Roaming\29.exe
                                      4⤵
                                      • Executes dropped EXE
                                      PID:3456
                                      • C:\Windows\SysWOW64\regsvr32.exe
                                        C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@3456
                                        5⤵
                                        • Loads dropped DLL
                                        PID:3144
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f0
                                          6⤵
                                          • Blacklisted process makes network request
                                          • Loads dropped DLL
                                          PID:5092
                                    • C:\Users\Admin\AppData\Roaming\30.exe
                                      C:\Users\Admin\AppData\Roaming\30.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • Drops startup file
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:4384
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                        "C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"
                                        5⤵
                                        • Drops file in Drivers directory
                                        • Adds Run key to start application
                                        PID:4284
                                        • C:\Windows\SysWOW64\REG.exe
                                          REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                          6⤵
                                          • Modifies registry key
                                          PID:4904
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 1488
                                          6⤵
                                          • Drops file in Windows directory
                                          • Program crash
                                          PID:2312
                                    • C:\Users\Admin\AppData\Roaming\31.exe
                                      C:\Users\Admin\AppData\Roaming\31.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4500
                                • C:\Windows\SysWOW64\raserver.exe
                                  "C:\Windows\SysWOW64\raserver.exe"
                                  2⤵
                                  • Adds Run key to start application
                                  • Suspicious use of SetThreadContext
                                  • Modifies Internet Explorer settings
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:3804
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /c del "C:\Users\Admin\AppData\Roaming\2.exe"
                                    3⤵
                                      PID:3460
                                  • C:\Windows\SysWOW64\msdt.exe
                                    "C:\Windows\SysWOW64\msdt.exe"
                                    2⤵
                                    • Adds policy Run key to start application
                                    • Suspicious use of SetThreadContext
                                    • Modifies Internet Explorer settings
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4780
                                    • C:\Windows\SysWOW64\cmd.exe
                                      /c del "C:\Users\Admin\AppData\Roaming\18.exe"
                                      3⤵
                                        PID:4316
                                    • C:\Windows\SysWOW64\control.exe
                                      "C:\Windows\SysWOW64\control.exe"
                                      2⤵
                                      • Adds policy Run key to start application
                                      • Suspicious use of SetThreadContext
                                      • Modifies Internet Explorer settings
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2216
                                      • C:\Windows\SysWOW64\cmd.exe
                                        /c del "C:\Users\Admin\AppData\Roaming\11.exe"
                                        3⤵
                                          PID:1960
                                      • C:\Program Files (x86)\Wkdfhwn\_x0xzhcdx.exe
                                        "C:\Program Files (x86)\Wkdfhwn\_x0xzhcdx.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Checks BIOS information in registry
                                        • Maps connected drives based on registry
                                        • Suspicious use of SetThreadContext
                                        PID:4116
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8D00.tmp"
                                          3⤵
                                          • Creates scheduled task(s)
                                          PID:4788
                                        • C:\Program Files (x86)\Wkdfhwn\_x0xzhcdx.exe
                                          "{path}"
                                          3⤵
                                          • Executes dropped EXE
                                          PID:4476
                                        • C:\Program Files (x86)\Wkdfhwn\_x0xzhcdx.exe
                                          "{path}"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: MapViewOfSection
                                          PID:620
                                      • C:\Windows\SysWOW64\cmstp.exe
                                        "C:\Windows\SysWOW64\cmstp.exe"
                                        2⤵
                                          PID:5076
                                        • C:\Program Files (x86)\Eujox8n\ovoupi0l2.exe
                                          "C:\Program Files (x86)\Eujox8n\ovoupi0l2.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Maps connected drives based on registry
                                          • Suspicious use of SetThreadContext
                                          • Suspicious behavior: MapViewOfSection
                                          PID:1000
                                        • C:\Windows\SysWOW64\explorer.exe
                                          "C:\Windows\SysWOW64\explorer.exe"
                                          2⤵
                                            PID:2976
                                        • C:\Windows\system32\vssvc.exe
                                          C:\Windows\system32\vssvc.exe
                                          1⤵
                                          • Modifies service
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4888
                                        • C:\Users\Admin\AppData\Roaming\27.exe
                                          C:\Users\Admin\AppData\Roaming\27.exe /I flibpnt
                                          1⤵
                                          • Executes dropped EXE
                                          PID:2248
                                          • C:\Windows\system32\reg.exe
                                            C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
                                            2⤵
                                              PID:2296
                                            • C:\Windows\system32\reg.exe
                                              C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
                                              2⤵
                                                PID:5112
                                            • C:\Program Files\Internet Explorer\iexplore.exe
                                              "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                                              1⤵
                                              • Modifies Internet Explorer settings
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4816
                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4816 CREDAT:82945 /prefetch:2
                                                2⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4444
                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4816 CREDAT:82947 /prefetch:2
                                                2⤵
                                                • Modifies Internet Explorer settings
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5060

                                            Network

                                            MITRE ATT&CK Enterprise v6

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • memory/192-59-0x00000000059F0000-0x00000000059F1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/192-94-0x00000000086C0000-0x0000000008713000-memory.dmp

                                              Filesize

                                              332KB

                                              Download

                                            • memory/192-85-0x00000000055D0000-0x00000000055D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/192-91-0x00000000056C0000-0x00000000056C2000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/192-64-0x00000000054F0000-0x00000000054F1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/192-46-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/192-99-0x00000000087C0000-0x00000000087C1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/192-54-0x0000000000B80000-0x0000000000B81000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/200-109-0x0000000002F53000-0x0000000002F54000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/200-111-0x0000000003040000-0x0000000003041000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/416-518-0x0000000000400000-0x000000000044C000-memory.dmp

                                              Filesize

                                              304KB

                                              Download

                                            • memory/416-519-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/416-516-0x0000000000400000-0x000000000044C000-memory.dmp

                                              Filesize

                                              304KB

                                              Download

                                            • memory/1000-472-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/1028-596-0x00000210390A9000-0x00000210390EC000-memory.dmp

                                              Filesize

                                              268KB

                                              Download

                                            • memory/1196-565-0x0000000002720000-0x0000000002721000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1892-343-0x0000000006190000-0x00000000061E1000-memory.dmp

                                              Filesize

                                              324KB

                                              Download

                                            • memory/1892-290-0x0000000000800000-0x0000000000801000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1892-323-0x0000000007610000-0x000000000766D000-memory.dmp

                                              Filesize

                                              372KB

                                              Download

                                            • memory/1892-333-0x00000000054D0000-0x00000000054E0000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/1892-289-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/2216-489-0x0000000005F80000-0x0000000006115000-memory.dmp

                                              Filesize

                                              1.6MB

                                              Download

                                            • memory/2216-227-0x0000000000920000-0x0000000000940000-memory.dmp

                                              Filesize

                                              128KB

                                              Download

                                            • memory/2216-430-0x0000000004750000-0x0000000004780000-memory.dmp

                                              Filesize

                                              192KB

                                              Download

                                            • memory/2216-230-0x0000000000920000-0x0000000000940000-memory.dmp

                                              Filesize

                                              128KB

                                              Download

                                            • memory/2312-504-0x0000000005120000-0x0000000005121000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2312-484-0x00000000049F0000-0x00000000049F1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2416-18-0x0000000000400000-0x000000000042D000-memory.dmp

                                              Filesize

                                              180KB

                                              Download

                                            • memory/2544-692-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-606-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-591-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-700-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-699-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-702-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-697-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-703-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-585-0x0000000006530000-0x0000000006531000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-704-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-694-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-595-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-583-0x0000000006530000-0x0000000006531000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-691-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-582-0x0000000006530000-0x0000000006531000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-689-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-688-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-597-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-687-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-705-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-600-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-686-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-605-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-685-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-684-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-683-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-682-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-681-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-680-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-679-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-706-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-701-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-607-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-652-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-608-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-609-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-611-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-676-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-707-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-675-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-614-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-673-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-671-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-670-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-708-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-668-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-649-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-667-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-581-0x0000000006530000-0x0000000006531000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-665-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-651-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-662-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-661-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-657-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-745-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2544-741-0x0000000006430000-0x0000000006431000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2976-482-0x0000000000F30000-0x000000000136F000-memory.dmp

                                              Filesize

                                              4.2MB

                                              Download

                                            • memory/2976-483-0x0000000000F30000-0x000000000136F000-memory.dmp

                                              Filesize

                                              4.2MB

                                              Download

                                            • memory/3424-47-0x0000000000560000-0x0000000000570000-memory.dmp

                                              Filesize

                                              64KB

                                              Download

                                            • memory/3456-380-0x00000000036F0000-0x00000000036F1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/3496-237-0x0000000000400000-0x000000000044E000-memory.dmp

                                              Filesize

                                              312KB

                                              Download

                                            • memory/3804-579-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-617-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-559-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-594-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-695-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-598-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-729-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-467-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-53-0x00000000002D0000-0x00000000002EF000-memory.dmp

                                              Filesize

                                              124KB

                                              Download

                                            • memory/3804-122-0x0000000005630000-0x00000000056CE000-memory.dmp

                                              Filesize

                                              632KB

                                              Download

                                            • memory/3804-553-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-552-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-57-0x00000000002D0000-0x00000000002EF000-memory.dmp

                                              Filesize

                                              124KB

                                              Download

                                            • memory/3804-655-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-514-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-677-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-562-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-738-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-674-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-485-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-558-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-737-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-727-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-653-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-578-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-633-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-436-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-576-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-424-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-635-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-568-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-573-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-572-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-711-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-712-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-563-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-693-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3804-569-0x00000000056F0000-0x00000000057A3000-memory.dmp

                                              Filesize

                                              716KB

                                              Download

                                            • memory/3812-74-0x0000000004B30000-0x0000000004B32000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/3812-72-0x0000000002530000-0x000000000253F000-memory.dmp

                                              Filesize

                                              60KB

                                              Download

                                            • memory/3812-55-0x0000000000240000-0x0000000000241000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/3812-95-0x0000000004D40000-0x0000000004D42000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/3812-100-0x0000000004F20000-0x0000000004F21000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/3812-102-0x0000000004D50000-0x0000000004D52000-memory.dmp

                                              Filesize

                                              8KB

                                              Download

                                            • memory/3812-43-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/3824-104-0x00000000036A0000-0x00000000036A1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/3904-179-0x0000000003110000-0x0000000003111000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/3904-173-0x0000000002E23000-0x0000000002E24000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4264-311-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/4264-304-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                              Download

                                            • memory/4276-292-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4276-208-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                              Download

                                            • memory/4276-214-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/4284-412-0x0000000000400000-0x0000000000401000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4284-411-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/4284-409-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                              Download

                                            • memory/4288-417-0x0000000002750000-0x0000000002751000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4308-246-0x0000000003200000-0x0000000003201000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4308-243-0x0000000003113000-0x0000000003114000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4332-354-0x0000000002710000-0x0000000002711000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4404-139-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/4404-141-0x0000000000420000-0x0000000000421000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4404-147-0x0000000004C80000-0x0000000004CCD000-memory.dmp

                                              Filesize

                                              308KB

                                              Download

                                            • memory/4404-148-0x0000000004E20000-0x0000000004E5A000-memory.dmp

                                              Filesize

                                              232KB

                                              Download

                                            • memory/4416-233-0x0000000000720000-0x0000000000721000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4416-223-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/4416-240-0x0000000001190000-0x0000000001191000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4416-278-0x000000000A9F0000-0x000000000A9F1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4416-269-0x000000000DD10000-0x000000000DEA2000-memory.dmp

                                              Filesize

                                              1.6MB

                                              Download

                                            • memory/4416-275-0x0000000001130000-0x0000000001131000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4584-358-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/4584-352-0x0000000000400000-0x0000000000452000-memory.dmp

                                              Filesize

                                              328KB

                                              Download

                                            • memory/4780-429-0x0000000002540000-0x00000000025F6000-memory.dmp

                                              Filesize

                                              728KB

                                              Download

                                            • memory/4780-183-0x00000000003C0000-0x0000000000533000-memory.dmp

                                              Filesize

                                              1.4MB

                                              Download

                                            • memory/4780-181-0x00000000003C0000-0x0000000000533000-memory.dmp

                                              Filesize

                                              1.4MB

                                              Download

                                            • memory/4780-494-0x0000000005DA0000-0x0000000005EEE000-memory.dmp

                                              Filesize

                                              1.3MB

                                              Download

                                            • memory/4780-297-0x0000000004540000-0x000000000463D000-memory.dmp

                                              Filesize

                                              1012KB

                                              Download

                                            • memory/4840-175-0x0000000000400000-0x000000000042D000-memory.dmp

                                              Filesize

                                              180KB

                                              Download

                                            • memory/4856-440-0x00000000001C0000-0x00000000001FA000-memory.dmp

                                              Filesize

                                              232KB

                                              Download

                                            • memory/4856-418-0x00000000001C0000-0x00000000001FA000-memory.dmp

                                              Filesize

                                              232KB

                                              Download

                                            • memory/4856-426-0x00000000001C0000-0x00000000001FA000-memory.dmp

                                              Filesize

                                              232KB

                                              Download

                                            • memory/4916-390-0x0000000000400000-0x0000000000450000-memory.dmp

                                              Filesize

                                              320KB

                                              Download

                                            • memory/4916-394-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/4936-188-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/4936-298-0x0000000006130000-0x0000000006131000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4956-282-0x00000000082E0000-0x0000000008333000-memory.dmp

                                              Filesize

                                              332KB

                                              Download

                                            • memory/4956-260-0x00000000007C0000-0x00000000007C1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/4956-259-0x0000000071A90000-0x000000007217E000-memory.dmp

                                              Filesize

                                              6.9MB

                                              Download

                                            • memory/5076-460-0x0000000001160000-0x0000000001176000-memory.dmp

                                              Filesize

                                              88KB

                                              Download

                                            • memory/5076-462-0x0000000001160000-0x0000000001176000-memory.dmp

                                              Filesize

                                              88KB

                                              Download