Overview

overview

10

Static

static

1

2c009fefcf...74.exe

windows7-x64

10

2c009fefcf...74.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2c009fefcf337b8b5e4f0249aeb1627d3a39934097cf5fea75b16c5aa9a7f374.exe
  • Size 7.8MB
  • Sample240107-yqrfhadbfq
  • SHA256 2c009fefcf337b8b5e4f0249aeb1627d3a39934097cf5fea75b16c5aa9a7f374
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
betabotdcratgluptebasmokeloaderbackdoorbotnetdiscoverydropperevasioninfostealerloaderpersistencerattrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://host-file-host6.com/

  • http://host-host-file8.com/

rc4.i32
rc4.i32

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • DcRat 11 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 16 IoCs
  • Modifies firewall policy service 2 TTPs 8 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 11 IoCs
    evasiontrojan
  • Enumerates VirtualBox registry keys 2 TTPs 10 IoCs
    evasion
  • Disables taskbar notifications via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Downloads MZ/PE file
  • Looks for VMWare services registry key. 1 TTPs 3 IoCs
    evasion
  • Modifies Windows Firewall 1 TTPs 3 IoCs
    evasion
  • Sets file execution options in registry 2 TTPs 20 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 10 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 41 IoCs
  • Windows security modification 2 TTPs 12 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 7 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • NSIS installer 4 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    evasionspywaretrojan
  • NTFS ADS 2 IoCs
  • Runs net.exe
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1264
    • C:\Users\Admin\AppData\Local\Temp\2c009fefcf337b8b5e4f0249aeb1627d3a39934097cf5fea75b16c5aa9a7f374.exe
      "C:\Users\Admin\AppData\Local\Temp\2c009fefcf337b8b5e4f0249aeb1627d3a39934097cf5fea75b16c5aa9a7f374.exe"
      2⤵
      • DcRat
      • UAC bypass
      • Windows security bypass
      • Windows security modification
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1216
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2c009fefcf337b8b5e4f0249aeb1627d3a39934097cf5fea75b16c5aa9a7f374.exe" -Force
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2312
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
        3⤵
        • DcRat
        • Looks for VMWare services registry key.
        • Drops startup file
        • Loads dropped DLL
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Users\Admin\Pictures\BiyvJBxmsYIsj3w2Mg10se2t.exe
          "C:\Users\Admin\Pictures\BiyvJBxmsYIsj3w2Mg10se2t.exe"
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:2748
        • C:\Users\Admin\Pictures\oLqQHqsHmJMCRWCViNB0jE7W.exe
          "C:\Users\Admin\Pictures\oLqQHqsHmJMCRWCViNB0jE7W.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1720
          • C:\Users\Admin\AppData\Local\Temp\is-POPML.tmp\oLqQHqsHmJMCRWCViNB0jE7W.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-POPML.tmp\oLqQHqsHmJMCRWCViNB0jE7W.tmp" /SL5="$9015C,4774704,351744,C:\Users\Admin\Pictures\oLqQHqsHmJMCRWCViNB0jE7W.exe"
            5⤵
            • Looks for VMWare services registry key.
            • Executes dropped EXE
            • Loads dropped DLL
            • Checks whether UAC is enabled
            • Maps connected drives based on registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1180
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\system32\net.exe" helpmsg 173
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2652
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 helpmsg 173
                7⤵
                  PID:3060
              • C:\Users\Admin\AppData\Local\JS DomainKey lib\jsdomainkeylib.exe
                "C:\Users\Admin\AppData\Local\JS DomainKey lib\jsdomainkeylib.exe" -i
                6⤵
                • Executes dropped EXE
                PID:568
              • C:\Users\Admin\AppData\Local\JS DomainKey lib\jsdomainkeylib.exe
                "C:\Users\Admin\AppData\Local\JS DomainKey lib\jsdomainkeylib.exe" -s
                6⤵
                • Looks for VMWare services registry key.
                • Executes dropped EXE
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Maps connected drives based on registry
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:2312
          • C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
            "C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2496
            • C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
              "C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:2980
              • C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
                "C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:2024
                • C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
                  "C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe"
                  7⤵
                  • Windows security bypass
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Windows security modification
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  PID:2028
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    8⤵
                      PID:1924
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                        9⤵
                        • Modifies Windows Firewall
                        • Modifies data under HKEY_USERS
                        PID:1688
                    • C:\Windows\rss\csrss.exe
                      C:\Windows\rss\csrss.exe
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:684
                      • C:\Windows\rss\csrss.exe
                        C:\Windows\rss\csrss.exe
                        9⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Modifies system certificate store
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2336
                        • C:\Windows\system32\schtasks.exe
                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                          10⤵
                          • DcRat
                          • Creates scheduled task(s)
                          PID:840
                        • C:\Windows\system32\schtasks.exe
                          schtasks /delete /tn ScheduledUpdate /f
                          10⤵
                            PID:2032
                          • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                            "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                            10⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Modifies system certificate store
                            PID:2640
                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                            10⤵
                            • Executes dropped EXE
                            PID:2016
              • C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                "C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1128
                • C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                  "C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1092
                  • C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                    "C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:2044
                    • C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                      "C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe"
                      7⤵
                      • Windows security bypass
                      • Executes dropped EXE
                      • Windows security modification
                      • Adds Run key to start application
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      • Drops file in Windows directory
                      PID:2672
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                        8⤵
                          PID:2640
                          • C:\Windows\system32\netsh.exe
                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                            9⤵
                            • Modifies Windows Firewall
                            PID:2116
                • C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                  "C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2328
                  • C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                    "C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1812
                    • C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                      "C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe"
                      6⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2648
                      • C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                        "C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe"
                        7⤵
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Adds Run key to start application
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:2508
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                          8⤵
                            PID:600
                            • C:\Windows\system32\netsh.exe
                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                              9⤵
                              • Modifies Windows Firewall
                              PID:672
                  • C:\Users\Admin\Pictures\suqMkTkvixVaxWndpOa5DIMV.exe
                    "C:\Users\Admin\Pictures\suqMkTkvixVaxWndpOa5DIMV.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2140
                    • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                      C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                      5⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of SetWindowsHookEx
                      PID:2552
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 1016
                      5⤵
                      • Loads dropped DLL
                      • Program crash
                      PID:780
                  • C:\Users\Admin\Pictures\FvO7TWEoaE7KuJHt3rug3fqw.exe
                    "C:\Users\Admin\Pictures\FvO7TWEoaE7KuJHt3rug3fqw.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1084
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 492
                      5⤵
                      • Loads dropped DLL
                      • Program crash
                      PID:1628
              • C:\Users\Admin\AppData\Local\Temp\33BD.exe
                C:\Users\Admin\AppData\Local\Temp\33BD.exe
                2⤵
                • Sets file execution options in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:1840
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  3⤵
                  • Modifies firewall policy service
                  • Sets file execution options in registry
                  • Checks BIOS information in registry
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Drops desktop.ini file(s)
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Drops file in Windows directory
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies Internet Explorer Protected Mode
                  • Modifies Internet Explorer Protected Mode Banner
                  • Modifies Internet Explorer settings
                  • NTFS ADS
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2120
                  • C:\Users\Admin\AppData\Local\Temp\33k1gu53y1_1.exe
                    /suac
                    4⤵
                    • Modifies firewall policy service
                    • Enumerates VirtualBox registry keys
                    • Sets file execution options in registry
                    • Executes dropped EXE
                    • Checks for any installed AV software in registry
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Checks processor information in registry
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1636
                    • C:\Windows\SysWOW64\regedit.exe
                      "C:\Windows\SysWOW64\regedit.exe"
                      5⤵
                      • Modifies security service
                      • Sets file execution options in registry
                      • Sets service image path in registry
                      • Runs regedit.exe
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1660
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\33K1GU~1.EXE" /RL HIGHEST
                      5⤵
                      • DcRat
                      • Creates scheduled task(s)
                      PID:2004
              • C:\Users\Admin\AppData\Local\Temp\96F3.exe
                C:\Users\Admin\AppData\Local\Temp\96F3.exe
                2⤵
                • Executes dropped EXE
                PID:3048
            • C:\Windows\system32\Dwm.exe
              "C:\Windows\system32\Dwm.exe"
              1⤵
                PID:1228
              • C:\Windows\system32\makecab.exe
                "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240107200035.log C:\Windows\Logs\CBS\CbsPersist_20240107200035.cab
                1⤵
                • Drops file in Windows directory
                PID:968
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                1⤵
                  PID:1976
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                  1⤵
                    PID:1492

                  Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Scheduled Task/Job

                        1
                        T1053

                        Persistence

                        Boot or Logon Autostart Execution

                        3
                        T1547

                        Registry Run Keys / Startup Folder

                        3
                        T1547.001

                        Create or Modify System Process

                        3
                        T1543

                        Windows Service

                        3
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Boot or Logon Autostart Execution

                        3
                        T1547

                        Registry Run Keys / Startup Folder

                        3
                        T1547.001

                        Create or Modify System Process

                        3
                        T1543

                        Windows Service

                        3
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Impair Defenses

                        3
                        T1562

                        Disable or Modify Tools

                        3
                        T1562.001

                        Modify Registry

                        13
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Discovery

                        Peripheral Device Discovery

                        2
                        T1120

                        Query Registry

                        8
                        T1012

                        Software Discovery

                        1
                        T1518

                        Security Software Discovery

                        1
                        T1518.001

                        System Information Discovery

                        8
                        T1082

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Inhibit System Recovery

                        1
                        T1490

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        94308059B57B3142E455B38A6EB92015
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                        • Size 344B
                        • SHA256 147e3454e04fb0ac806e50936be352478b484a4806860e14650505ff8a93f598
                        • MD5 SHA1 SHA512
                        Submit Download

                        94308059B57B3142E455B38A6EB92015
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                        • Size 344B
                        • SHA256 b1f04038a0a816d15ee9d54daa545e8d19267595bd2ffca9d0691a729dd7223e
                        • MD5 SHA1 SHA512
                        Submit Download

                        jsdomainkeylib.exe
                        • Path C:\Users\Admin\AppData\Local\JS DomainKey lib\jsdomainkeylib.exe
                        • Size 1.4MB
                        • SHA256 56a19dfed4fe2a6d273a9385ac757e7245487bc236d0c3c83c2f00f5016f388e
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        33BD.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\33BD.exe
                        • Size 360KB
                        • SHA256 6d99cec56614b6b8a23dfa84a50c6bbfde535411c6366ac2bcc20c9f5af62880
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        96F3.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\96F3.exe
                        • Size 64KB
                        • SHA256 720bbff1fce95f63d4ca9c8b4653844ea87eb884e130e749a2838bef4ae933ec
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        96F3.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\96F3.exe
                        • Size 5.6MB
                        • SHA256 4e07a3356bb6ffaa23224884b2ec5d79b6f956acc186475adac89867c0d623d9
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        CabC831.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\CabC831.tmp
                        • Size 65KB
                        • SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        TarC872.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\TarC872.tmp
                        • Size 171KB
                        • SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        oLqQHqsHmJMCRWCViNB0jE7W.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\is-POPML.tmp\oLqQHqsHmJMCRWCViNB0jE7W.tmp
                        • Size 688KB
                        • SHA256 05f159722d6905719d2d6f340981a293f40ab8a0d2d4a282c948066809d4af6d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Checker.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\nsoD125.tmp\Checker.dll
                        • Size 41KB
                        • SHA256 82ab2915f0c86cbdc4acc8ce4efd85af374b19d0d9f5c06006b20ba7bff56383
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        ntkrnlmp.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                        • Size 5.3MB
                        • SHA256 c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        osloader.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\osloader.exe
                        • Size 591KB
                        • SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        dcKuDJdVLw48nsXLXcrTfXS7.exe
                        • Path C:\Users\Admin\AppData\Local\dcKuDJdVLw48nsXLXcrTfXS7.exe
                        • Size 212B
                        • SHA256 8720b9487cee7dae6db3f8f73273bcbbc56377400b830ca0f089473ebc9603f2
                        • MD5 SHA1 SHA512
                        Submit Download

                        0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Path C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Size 4.2MB
                        • SHA256 3b28beed24fa83e0d66858c5f8ba00f5d16872253c2a23743e8ee602fe8582bc
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Path C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Size 2.9MB
                        • SHA256 2dc320d1c8f47b215ba237cdaa9b75c61911e194b0f2f8973fed7f919be27926
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Path C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Size 640KB
                        • SHA256 9d8a41d98ffa72199ef6e442dfcab9eee3fe11e1c612e04c12cf6c6d62adc7d0
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Path C:\Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Size 384KB
                        • SHA256 e2a1cd7a374258050b5289b899f0cbcb81ad2a384ee220dad9b70b651a739db8
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Path C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Size 3.3MB
                        • SHA256 eda3a32c6bdd76fb9a9569902215cee504461ea676f2a19c0c242971bb815ef5
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Path C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Size 3.0MB
                        • SHA256 85f8c5579be0384054cc84023c4b147d97e10265ac350050675a3df64636b3a3
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Path C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Size 768KB
                        • SHA256 ae3b0705163ed885feadc1dabdeec12c85a8b897249050df8fe8220e92775e58
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Path C:\Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Size 640KB
                        • SHA256 719b5637995c793f0cf227a39791f1cf6a5ba7273bf1694eb9edc7cfec13cdd6
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        FvO7TWEoaE7KuJHt3rug3fqw.exe
                        • Path C:\Users\Admin\Pictures\FvO7TWEoaE7KuJHt3rug3fqw.exe
                        • Size 4.3MB
                        • SHA256 679a262683269630fd0a597ca8a8495766d6a2950c406e12c821c9b19c290d23
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        nR2LXei6PABdKD0MhQio33Sk.exe
                        • Path C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                        • Size 2.6MB
                        • SHA256 b054682be2b38fd150e6e263e5e575600c9c55aa25b6fb8c44e2f686d086fcfc
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        nR2LXei6PABdKD0MhQio33Sk.exe
                        • Path C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                        • Size 1.1MB
                        • SHA256 b0d09984237da1c61dd706e0cb356e226952811e439872cd49bdc587fdc65a7f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        nR2LXei6PABdKD0MhQio33Sk.exe
                        • Path C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                        • Size 960KB
                        • SHA256 2400a7073f4b07be1df8ed378fbde182549f8d2bf53371cae839f9c1602b782b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        nR2LXei6PABdKD0MhQio33Sk.exe
                        • Path C:\Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                        • Size 3.3MB
                        • SHA256 c4d1ef7de602fa613dbbf7c8208954f4d4894838039acbca58e95ff6e5c02656
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        oLqQHqsHmJMCRWCViNB0jE7W.exe
                        • Path C:\Users\Admin\Pictures\oLqQHqsHmJMCRWCViNB0jE7W.exe
                        • Size 1.4MB
                        • SHA256 99d852bbc5d2df92d3f811a024f132aec325c017f178d1889bcf121fbf7647fa
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        oLqQHqsHmJMCRWCViNB0jE7W.exe
                        • Path C:\Users\Admin\Pictures\oLqQHqsHmJMCRWCViNB0jE7W.exe
                        • Size 3.1MB
                        • SHA256 227e6963b40c3e7af2555596674895cb0de3c1abed2c3ec0de1a29817e66df86
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        oLqQHqsHmJMCRWCViNB0jE7W.exe
                        • Path C:\Users\Admin\Pictures\oLqQHqsHmJMCRWCViNB0jE7W.exe
                        • Size 4.8MB
                        • SHA256 e8ba8ac403faa98437d491dd4e832f0c93f941ea3c12d2e91b05c9046646186b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        suqMkTkvixVaxWndpOa5DIMV.exe
                        • Path C:\Users\Admin\Pictures\suqMkTkvixVaxWndpOa5DIMV.exe
                        • Size 2.4MB
                        • SHA256 af6ff8354e09faeb9176f009033b136853a92d2e67eb049449ce9a0f849e66f5
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        csrss.exe
                        • Path C:\Windows\rss\csrss.exe
                        • Size 1.9MB
                        • SHA256 17561d43ed6b0650a415572f70a8646b815d8252d1ec7d672187fb10efb62386
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        jsdomainkeylib.exe
                        • Path \Users\Admin\AppData\Local\JS DomainKey lib\jsdomainkeylib.exe
                        • Size 768KB
                        • SHA256 5a9a856c3592e39ea7bd4ce734d3697a5da5bb626043879d602d9d54c4c0da5e
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        BroomSetup.exe
                        • Path \Users\Admin\AppData\Local\Temp\BroomSetup.exe
                        • Size 5.3MB
                        • SHA256 ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        patch.exe
                        • Path \Users\Admin\AppData\Local\Temp\csrss\patch.exe
                        • Size 1.7MB
                        • SHA256 f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        dbghelp.dll
                        • Path \Users\Admin\AppData\Local\Temp\dbghelp.dll
                        • Size 1.5MB
                        • SHA256 6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        _iscrypt.dll
                        • Path \Users\Admin\AppData\Local\Temp\is-90IQJ.tmp\_isetup\_iscrypt.dll
                        • Size 2KB
                        • SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
                        • MD5 SHA1 SHA512
                        Submit Download

                        _isdecmp.dll
                        • Path \Users\Admin\AppData\Local\Temp\is-90IQJ.tmp\_isetup\_isdecmp.dll
                        • Size 19KB
                        • SHA256 71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        _shfoldr.dll
                        • Path \Users\Admin\AppData\Local\Temp\is-90IQJ.tmp\_isetup\_shfoldr.dll
                        • Size 22KB
                        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        INetC.dll
                        • Path \Users\Admin\AppData\Local\Temp\nsjC65D.tmp\INetC.dll
                        • Size 25KB
                        • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Zip.dll
                        • Path \Users\Admin\AppData\Local\Temp\nsoD125.tmp\Zip.dll
                        • Size 76KB
                        • SHA256 23dfb2a6b53106509444bec24b9c3893a82f8f04520f03f6b1696f53d19170c5
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        symsrv.dll
                        • Path \Users\Admin\AppData\Local\Temp\symsrv.dll
                        • Size 163KB
                        • SHA256 e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Path \Users\Admin\Pictures\0wbxXoWwAx7STbdYwDjfk6d5.exe
                        • Size 3.2MB
                        • SHA256 3513b896fe8199b587c13a3c4b2df65ce797d70c17457cd0dbfc0074afb61fa8
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Path \Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Size 4.2MB
                        • SHA256 6e9970a3c8c0ca2030f8580b34686a1b853191a3b8af770c70722b89bc8542a2
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Path \Users\Admin\Pictures\3VaVC6Erfh3qIgwGaYErbFYb.exe
                        • Size 3.9MB
                        • SHA256 698227c6403c4c8830344931a32a36d61bc55df6140eb539cebc61d0d7c7f0f3
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        BiyvJBxmsYIsj3w2Mg10se2t.exe
                        • Path \Users\Admin\Pictures\BiyvJBxmsYIsj3w2Mg10se2t.exe
                        • Size 311KB
                        • SHA256 0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        nR2LXei6PABdKD0MhQio33Sk.exe
                        • Path \Users\Admin\Pictures\nR2LXei6PABdKD0MhQio33Sk.exe
                        • Size 3.4MB
                        • SHA256 0df1a4c47dc135c8f3a161e728cfc6378645490ca9376c2db96c4306296d6375
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        oLqQHqsHmJMCRWCViNB0jE7W.exe
                        • Path \Users\Admin\Pictures\oLqQHqsHmJMCRWCViNB0jE7W.exe
                        • Size 1.6MB
                        • SHA256 aacada8ff6c6329483a2077e3a41e40364045b094b7bfe7c4fad3b82238d7cf4
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        csrss.exe
                        • Path \Windows\rss\csrss.exe
                        • Size 1.4MB
                        • SHA256 0bda5c2188461189bc9fec4084e21c3827bc262755f84465c450bfd3d1e1a4af
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        csrss.exe
                        • Path \Windows\rss\csrss.exe
                        • Size 1.6MB
                        • SHA256 9a9a1fe008c0a09f3b182d8f878b11264a24ac86f0674fa10e01bb81f31a8964
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        memory/568-732-0x0000000000400000-0x000000000056B000-memory.dmp
                        Download

                        memory/568-720-0x0000000000400000-0x000000000056B000-memory.dmp
                        Download

                        memory/1092-799-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/1092-859-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/1092-811-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/1092-796-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/1128-756-0x0000000000AC0000-0x0000000000EB8000-memory.dmp
                        Download

                        memory/1180-753-0x0000000000400000-0x00000000004BC000-memory.dmp
                        Download

                        memory/1216-30-0x00000000010E0000-0x0000000001202000-memory.dmp
                        Download

                        memory/1216-22-0x0000000000500000-0x0000000000511000-memory.dmp
                        Download

                        memory/1216-59-0x0000000000C60000-0x0000000000C76000-memory.dmp
                        Download

                        memory/1216-60-0x0000000000C60000-0x0000000000C86000-memory.dmp
                        Download

                        memory/1216-61-0x00000000010E0000-0x000000000113F000-memory.dmp
                        Download

                        memory/1216-63-0x00000000006A0000-0x00000000006A7000-memory.dmp
                        Download

                        memory/1216-62-0x0000000000C60000-0x0000000000C7A000-memory.dmp
                        Download

                        memory/1216-1-0x0000000001330000-0x0000000001B02000-memory.dmp
                        Download

                        memory/1216-2-0x0000000000500000-0x000000000050A000-memory.dmp
                        Download

                        memory/1216-3-0x0000000000500000-0x000000000052C000-memory.dmp
                        Download

                        memory/1216-51-0x0000000000C60000-0x0000000000C82000-memory.dmp
                        Download

                        memory/1216-50-0x0000000000C50000-0x0000000000C58000-memory.dmp
                        Download

                        memory/1216-49-0x00000000006A0000-0x00000000006A8000-memory.dmp
                        Download

                        memory/1216-48-0x0000000000BB0000-0x0000000000BBE000-memory.dmp
                        Download

                        memory/1216-47-0x00000000006A0000-0x00000000006AE000-memory.dmp
                        Download

                        memory/1216-46-0x00000000006A0000-0x00000000006A8000-memory.dmp
                        Download

                        memory/1216-45-0x00000000010E0000-0x000000000117C000-memory.dmp
                        Download

                        memory/1216-44-0x0000000000F60000-0x0000000000FDC000-memory.dmp
                        Download

                        memory/1216-43-0x0000000000C50000-0x0000000000CCC000-memory.dmp
                        Download

                        memory/1216-42-0x00000000006B0000-0x00000000006CE000-memory.dmp
                        Download

                        memory/1216-41-0x0000000000690000-0x00000000006AE000-memory.dmp
                        Download

                        memory/1216-40-0x0000000005680000-0x0000000005949000-memory.dmp
                        Download

                        memory/1216-39-0x0000000000680000-0x00000000006A0000-memory.dmp
                        Download

                        memory/1216-38-0x0000000000C50000-0x0000000000CB0000-memory.dmp
                        Download

                        memory/1216-57-0x00000000006A0000-0x00000000006A6000-memory.dmp
                        Download

                        memory/1216-36-0x00000000010E0000-0x000000000119A000-memory.dmp
                        Download

                        memory/1216-35-0x0000000000680000-0x00000000006B0000-memory.dmp
                        Download

                        memory/1216-34-0x0000000000510000-0x0000000000520000-memory.dmp
                        Download

                        memory/1216-33-0x0000000000500000-0x0000000000510000-memory.dmp
                        Download

                        memory/1216-4-0x0000000000500000-0x0000000000523000-memory.dmp
                        Download

                        memory/1216-5-0x0000000000C50000-0x0000000000CCE000-memory.dmp
                        Download

                        memory/1216-6-0x0000000000500000-0x0000000000509000-memory.dmp
                        Download

                        memory/1216-7-0x0000000000500000-0x0000000000507000-memory.dmp
                        Download

                        memory/1216-28-0x00000000010E0000-0x0000000001184000-memory.dmp
                        Download

                        memory/1216-9-0x0000000000500000-0x0000000000514000-memory.dmp
                        Download

                        memory/1216-10-0x00000000054C0000-0x0000000005BAE000-memory.dmp
                        Download

                        memory/1216-11-0x0000000000500000-0x000000000051F000-memory.dmp
                        Download

                        memory/1216-12-0x0000000000600000-0x0000000000638000-memory.dmp
                        Download

                        memory/1216-32-0x0000000000C50000-0x0000000000CC6000-memory.dmp
                        Download

                        memory/1216-31-0x0000000000680000-0x00000000006C4000-memory.dmp
                        Download

                        memory/1216-52-0x0000000000C90000-0x0000000000CB2000-memory.dmp
                        Download

                        memory/1216-29-0x0000000000500000-0x000000000051A000-memory.dmp
                        Download

                        memory/1216-37-0x00000000011A0000-0x000000000125A000-memory.dmp
                        Download

                        memory/1216-58-0x0000000005AC0000-0x0000000006022000-memory.dmp
                        Download

                        memory/1216-8-0x0000000000500000-0x000000000050A000-memory.dmp
                        Download

                        memory/1216-13-0x0000000000C50000-0x0000000000CD0000-memory.dmp
                        Download

                        memory/1216-14-0x0000000000500000-0x000000000051F000-memory.dmp
                        Download

                        memory/1216-27-0x00000000010E0000-0x000000000123A000-memory.dmp
                        Download

                        memory/1216-15-0x0000000000500000-0x000000000050D000-memory.dmp
                        Download

                        memory/1216-55-0x0000000005780000-0x000000000589F000-memory.dmp
                        Download

                        memory/1216-0-0x00000000747A0000-0x0000000074E8E000-memory.dmp
                        Download

                        memory/1216-54-0x0000000005780000-0x00000000058CF000-memory.dmp
                        Download

                        memory/1216-26-0x0000000000500000-0x0000000000518000-memory.dmp
                        Download

                        memory/1216-25-0x0000000000500000-0x0000000000510000-memory.dmp
                        Download

                        memory/1216-16-0x0000000000500000-0x0000000000518000-memory.dmp
                        Download

                        memory/1216-24-0x00000000005A0000-0x00000000005B2000-memory.dmp
                        Download

                        memory/1216-23-0x0000000000500000-0x0000000000512000-memory.dmp
                        Download

                        memory/1216-17-0x0000000000600000-0x0000000000628000-memory.dmp
                        Download

                        memory/1216-18-0x00000000010E0000-0x00000000011C8000-memory.dmp
                        Download

                        memory/1216-19-0x00000000010E0000-0x00000000011A3000-memory.dmp
                        Download

                        memory/1216-53-0x0000000000C60000-0x0000000000C79000-memory.dmp
                        Download

                        memory/1216-56-0x00000000010E0000-0x000000000115D000-memory.dmp
                        Download

                        memory/1216-20-0x0000000000600000-0x0000000000637000-memory.dmp
                        Download

                        memory/1216-21-0x0000000000500000-0x0000000000516000-memory.dmp
                        Download

                        memory/1264-688-0x00000000029F0000-0x0000000002A06000-memory.dmp
                        Download

                        memory/1720-752-0x0000000000400000-0x000000000045D000-memory.dmp
                        Download

                        memory/1812-838-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/1812-840-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/1812-839-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/1812-837-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/1840-849-0x0000000000520000-0x0000000000586000-memory.dmp
                        Download

                        memory/1840-848-0x0000000000010000-0x000000000006D000-memory.dmp
                        Download

                        memory/2024-865-0x0000000000B10000-0x0000000000F08000-memory.dmp
                        Download

                        memory/2088-395-0x0000000000400000-0x0000000000408000-memory.dmp
                        Download

                        memory/2088-397-0x0000000000400000-0x0000000000408000-memory.dmp
                        Download

                        memory/2088-400-0x0000000000400000-0x0000000000408000-memory.dmp
                        Download

                        memory/2328-827-0x0000000000B60000-0x0000000000F58000-memory.dmp
                        Download

                        memory/2496-676-0x0000000000C00000-0x0000000000FF8000-memory.dmp
                        Download

                        memory/2748-691-0x0000000000400000-0x0000000000454000-memory.dmp
                        Download

                        memory/2980-704-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/2980-701-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/2980-697-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/2980-690-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                        Download

                        memory/2980-714-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/2980-715-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/2980-721-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/2980-795-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download

                        memory/2980-852-0x0000000000400000-0x0000000000D1C000-memory.dmp
                        Download