Overview

overview

10

Static

static

3

6fe93f39a7...75.exe

windows7-x64

10

6fe93f39a7...75.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-01-2024 17:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6fe93f39a783d8d0a24d4679adc34675.exe

  • Size

    196KB

  • MD5

    6fe93f39a783d8d0a24d4679adc34675

  • SHA1

    ce9425cdba52b35cf94eb9a34f20e5a36f754629

  • SHA256

    e91ac2d0ba2fd89b2a9db98834e9f9d378736376d18babfd24b5f19939c1ef06

  • SHA512

    865c3e799ddee0aac1970e7097e356cef9172b4e06b43f2fed1ab89b35e7c5ef1b027c81cc3b6e056fc933a7c6ce1711ae63787a0f2272d2a4a95bcf1ae8d701

  • SSDEEP

    3072:BehvZ5uwVI0ecqWOgQmbNX/ZVC/5OoPM1mrkKFRrvPMQpetWgGrjgbaqqh7WeG7I:4hvDpGrgQShhyFMwrBFJUCe8/jMavq7I

Score
10/10
modiloaderevasionpersistencetrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • ModiLoader Second Stage 6 IoCs
  • Checks computer location settings 2 TTPs 64 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fe93f39a783d8d0a24d4679adc34675.exe
    "C:\Users\Admin\AppData\Local\Temp\6fe93f39a783d8d0a24d4679adc34675.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:432
    • C:\Users\Admin\AppData\Local\Temp\temp2.exe
      "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
      2⤵
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\svchost.exe
        "C:\Windows\svchost.exe" \melt "C:\Users\Admin\AppData\Local\Temp\temp2.exe"
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:216
    • C:\Users\Admin\AppData\Local\Temp\temp.exe
      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4088
      • C:\Users\Admin\AppData\Local\Temp\temp.exe
        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4080
        • C:\Users\Admin\AppData\Local\Temp\temp.exe
          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4336
          • C:\Users\Admin\AppData\Local\Temp\temp.exe
            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1852
            • C:\Users\Admin\AppData\Local\Temp\temp.exe
              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2608
              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2716
                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3652
                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2864
                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2368
                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2440
                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:5000
                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                            13⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:1920
                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                              14⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3056
                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                15⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:1932
                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2012
                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                    17⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:2988
                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4708
                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                        19⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2076
                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                          20⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:116
                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                            21⤵
                                            • Checks computer location settings
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4500
                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3212
                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                23⤵
                                                • Checks computer location settings
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4392
                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2156
                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                    25⤵
                                                    • Checks computer location settings
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:4560
                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                      26⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3372
                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                        27⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3832
                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                          28⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4612
                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                            29⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:708
                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4616
                                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1492
                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4308
                                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                    33⤵
                                                                    • Checks computer location settings
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:3756
                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:272
                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1244
                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                          36⤵
                                                                          • Checks computer location settings
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:432
                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                            37⤵
                                                                            • Checks computer location settings
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4612
                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2352
                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4844
                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                  40⤵
                                                                                  • Checks computer location settings
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:2004
                                                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:5200
                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                      42⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:5276
                                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                        43⤵
                                                                                        • Checks computer location settings
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:5364
                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                          44⤵
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:5460
                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                            45⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:5552
                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                              46⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:5628
                                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                47⤵
                                                                                                • Checks computer location settings
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:5704
                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5808
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                    49⤵
                                                                                                    • Checks computer location settings
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5920
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                      50⤵
                                                                                                      • Checks computer location settings
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:5996
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                        51⤵
                                                                                                        • Checks computer location settings
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:6100
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:5156
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                            53⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:5324
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                              54⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:5352
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5576
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5720
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                    57⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1540
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                      58⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:5712
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:1892
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                          60⤵
                                                                                                                          • Checks computer location settings
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:1764
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                            61⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:5224
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                              62⤵
                                                                                                                              • Checks computer location settings
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:4372
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:5492
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                  64⤵
                                                                                                                                    PID:4544
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                      65⤵
                                                                                                                                        PID:1500
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                          66⤵
                                                                                                                                          • Checks computer location settings
                                                                                                                                          PID:1640
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                            67⤵
                                                                                                                                              PID:6012
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                68⤵
                                                                                                                                                • Checks computer location settings
                                                                                                                                                PID:6124
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Checks computer location settings
                                                                                                                                                  PID:2744
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                    70⤵
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:5408
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Checks computer location settings
                                                                                                                                                      PID:5196
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                        72⤵
                                                                                                                                                        • Checks computer location settings
                                                                                                                                                        PID:4492
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                          73⤵
                                                                                                                                                            PID:5064
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                              74⤵
                                                                                                                                                              • Checks computer location settings
                                                                                                                                                              PID:3780
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                  PID:5868
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:320
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                        PID:4100
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:5624
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Checks computer location settings
                                                                                                                                                                              PID:6116
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                80⤵
                                                                                                                                                                                  PID:5384
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    PID:5648
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                      82⤵
                                                                                                                                                                                        PID:2876
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                          83⤵
                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                          PID:2880
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                            84⤵
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            PID:5580
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                                PID:2296
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                  86⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                      88⤵
                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                      PID:528
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                              92⤵
                                                                                                                                                                                                                PID:3252
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                    PID:2768
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                                        PID:5636
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                          95⤵
                                                                                                                                                                                                                            PID:4004
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                                PID:5564
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                    PID:2376
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          PID:508
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                            PID:5336
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                                                PID:624
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                                    PID:5284
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                      PID:6152
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                                          PID:6236
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                            PID:6320
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                PID:6412
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                    PID:6528
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                                                      PID:6588
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                                        109⤵
                                                                                                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                                                                                                        PID:6684
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                                          110⤵
                                                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                                                          PID:6876
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                                            111⤵
                                                                                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                                                                                            PID:6964
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                                              112⤵
                                                                                                                                                                                                                                                                                PID:7092
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\temp.exe"
                                                                                                                                                                                                                                                                                  113⤵
                                                                                                                                                                                                                                                                                    PID:6176
                                                  • C:\Windows\system32\vssvc.exe
                                                    C:\Windows\system32\vssvc.exe
                                                    1⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2632

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Temp\temp.exe
                                                    Filesize

                                                    42KB

                                                    MD5

                                                    2ef23f269292a736c8da033a1fe96131

                                                    SHA1

                                                    e3e1b43b6459b429c5ba8681b3401446732eaac1

                                                    SHA256

                                                    93830a42953f1c80ebd50489b329efc3f817454581fc26583f83dac8838748d7

                                                    SHA512

                                                    866c330687c1d4dbe4cee9b178b5eacd977141c627d70bfb8b7cdc9be95b6c8bb8c404a9ed69d38245379f62b835d356d0ed92c25b50adf5bcbaf7fece3e23a9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\temp2.exe
                                                    Filesize

                                                    48B

                                                    MD5

                                                    5fb42cd754eaeadf6fdcd0948b970498

                                                    SHA1

                                                    7715163b2a7f9934cceb7b1f4da3ac1bc074b963

                                                    SHA256

                                                    3bfe1b780db37217db7a1c1b3b4d3fdb74dce6e5a80572736f14ea0a44d2e58d

                                                    SHA512

                                                    9f44ead8f7e9e727586be4a6fc7453a7f612f997723e84af8fbb1b685f1c91f56cbaae1c7697b6064ae089a06c1f3d74b7df85d9de809f86512e611b5a94483a

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\temp2.exe
                                                    Filesize

                                                    111KB

                                                    MD5

                                                    b16f972641cf340d4c4806ceb8e88e53

                                                    SHA1

                                                    a0ad98e52b15cd0a081610de69de86c2135d3011

                                                    SHA256

                                                    abb5d4fdaf5cc7f060b5020b2c9fc9dca648b7b7ef59e287880934660f0a156f

                                                    SHA512

                                                    5d79776458093d85cbf95db382d389ba49aa2bfed6ccbec4501da807a6e10f736a46c10ad945b78b47e75ae888352fc007d2da31892191b9d2eec002d6c0690f

                                                    Download Submit

                                                  • C:\Windows\cmsetac.dll
                                                    Filesize

                                                    33KB

                                                    MD5

                                                    c9a695cfae0332a2b1e11520869dacad

                                                    SHA1

                                                    5ecc96f7c90db01b38e8b0be7a67c8abcd247d1f

                                                    SHA256

                                                    746cae0c4d0565d7969a146768489aac96f697af5007597ece5236f616424f44

                                                    SHA512

                                                    02e2fee81961f2bc9850489117fb5cb19584b4a8630704a2e5f4f3c1a45ca6f381902503b1ecf8cc691e0369737dd397fc73e92d420eea4773c88e7670b44308

                                                    Download Submit

                                                  • C:\Windows\ntdtcstp.dll
                                                    Filesize

                                                    7KB

                                                    MD5

                                                    67587e25a971a141628d7f07bd40ffa0

                                                    SHA1

                                                    76fcd014539a3bb247cc0b761225f68bd6055f6b

                                                    SHA256

                                                    e6829866322d68d5c5b78e3d48dcec70a41cdc42c6f357a44fd329f74a8b4378

                                                    SHA512

                                                    6e6de7aa02c48f8b96b06e5f1160fbc5c95312320636e138cc997ef3362a61bc50ec03db1f06292eb964cd71915ddb2ec2eb741432c7da44215a4acbb576a350

                                                    Download Submit

                                                  • memory/116-225-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/216-43-0x0000000003470000-0x000000000347E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/216-94-0x0000000000400000-0x0000000000450000-memory.dmp

                                                    Filesize

                                                    320KB

                                                    Download

                                                  • memory/216-31-0x0000000000400000-0x0000000000450000-memory.dmp

                                                    Filesize

                                                    320KB

                                                    Download

                                                  • memory/216-39-0x00000000005F0000-0x00000000005F1000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/216-105-0x0000000003470000-0x000000000347E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/216-104-0x0000000002740000-0x0000000002748000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/216-103-0x0000000000400000-0x0000000000450000-memory.dmp

                                                    Filesize

                                                    320KB

                                                    Download

                                                  • memory/216-154-0x0000000000400000-0x0000000000450000-memory.dmp

                                                    Filesize

                                                    320KB

                                                    Download

                                                  • memory/216-51-0x0000000003320000-0x0000000003321000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/272-357-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/432-373-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/432-0-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/432-17-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/708-302-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1244-365-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1492-322-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1500-691-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1540-606-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1640-705-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1764-537-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1852-74-0x0000000000690000-0x000000000069E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/1852-121-0x0000000000690000-0x000000000069E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/1852-120-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1852-71-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1892-624-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1920-167-0x0000000000570000-0x000000000057E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/1920-166-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1932-134-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/1932-135-0x00000000005A0000-0x00000000005AE000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/1932-128-0x00000000005A0000-0x00000000005AE000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2004-418-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2012-194-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2076-160-0x0000000000530000-0x000000000053E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2076-158-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2156-252-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2352-398-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2368-147-0x0000000000530000-0x000000000053E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2368-146-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2368-97-0x0000000000530000-0x000000000053E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2440-107-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2440-109-0x00000000004A0000-0x00000000004AE000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2440-101-0x00000000004A0000-0x00000000004AE000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2608-81-0x0000000000560000-0x000000000056E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2608-80-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2608-78-0x0000000000560000-0x000000000056E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2716-130-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2716-131-0x0000000000560000-0x000000000056E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2744-737-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2864-92-0x0000000000430000-0x000000000043E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2864-144-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/2864-145-0x0000000000430000-0x000000000043E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2988-201-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/3056-171-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/3212-237-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/3372-274-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/3652-88-0x0000000002020000-0x000000000202E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/3652-133-0x0000000002020000-0x000000000202E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/3652-132-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/3756-255-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/3832-282-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4080-106-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4080-108-0x0000000000570000-0x000000000057E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/4080-57-0x0000000000570000-0x000000000057E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/4088-50-0x0000000002EE0000-0x0000000002EEE000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/4088-53-0x0000000002EE0000-0x0000000002EEE000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/4088-52-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4088-12-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4308-333-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4336-114-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4336-68-0x0000000000580000-0x000000000058E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/4336-115-0x0000000000580000-0x000000000058E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/4372-659-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4392-183-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4468-28-0x0000000000400000-0x0000000000450000-memory.dmp

                                                    Filesize

                                                    320KB

                                                    Download

                                                  • memory/4468-30-0x0000000000820000-0x0000000000821000-memory.dmp

                                                    Filesize

                                                    4KB

                                                    Download

                                                  • memory/4468-19-0x0000000000400000-0x0000000000450000-memory.dmp

                                                    Filesize

                                                    320KB

                                                    Download

                                                  • memory/4500-229-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4544-582-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4560-264-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4612-295-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4612-219-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4616-314-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4708-150-0x0000000002120000-0x000000000212E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/4708-209-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/4844-407-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5000-162-0x0000000000540000-0x000000000054E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/5000-112-0x0000000000540000-0x000000000054E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/5000-161-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5064-683-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5156-553-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5200-426-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5224-648-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5276-345-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5324-563-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5352-569-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5364-452-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5408-745-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5460-462-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5492-671-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5552-476-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5576-485-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5628-482-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5704-401-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5712-614-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5720-600-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5808-507-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5920-519-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/5996-527-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/6012-715-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/6100-442-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download

                                                  • memory/6124-631-0x0000000000400000-0x000000000040FE00-memory.dmp

                                                    Filesize

                                                    63KB

                                                    Download