Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    303s
  • max time network
    299s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29-03-2024 01:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    583d73f0111e0aeed0a34fa4fc4ba85875a11f88ac93f9bacb59359aaf5b94e2.exe

  • Size

    294KB

  • MD5

    5700c54d51e14d0ce00bbbb6015baed2

  • SHA1

    71eb9361a9d6b35317fc8a385b748a8a6ce3bee7

  • SHA256

    583d73f0111e0aeed0a34fa4fc4ba85875a11f88ac93f9bacb59359aaf5b94e2

  • SHA512

    9dddd66cf82aead6400a19e81ccd0ebc0f5e312bc5772937e1929820a1db0fb74cf1480ef3bb9e9c70aefa25ce02c8c7d9f1a17bff6eb2137d76247a61eb2b9d

  • SSDEEP

    3072:QnAsasNY7mVLSD+i+XiXwc+ODB9mwsozColOZ8Y08rebNLC4NDBwo5XxrY:EAESDRfRN9lt5lOaYqbRntwAXx

Score
10/10
dcratdjvugluptebasmokeloaderpub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkittrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0857PsawqS

rsa_pubkey.plain

Signatures

  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 14 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 9 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 23 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of SetThreadContext 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\583d73f0111e0aeed0a34fa4fc4ba85875a11f88ac93f9bacb59359aaf5b94e2.exe
    "C:\Users\Admin\AppData\Local\Temp\583d73f0111e0aeed0a34fa4fc4ba85875a11f88ac93f9bacb59359aaf5b94e2.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2352
  • C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\B2BC.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:2676
    • C:\Users\Admin\AppData\Local\Temp\C5B0.exe
      C:\Users\Admin\AppData\Local\Temp\C5B0.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2944
      • C:\Users\Admin\AppData\Local\Temp\C5B0.exe
        C:\Users\Admin\AppData\Local\Temp\C5B0.exe
        2⤵
        • DcRat
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\8ce1e0cc-6707-455c-8b76-7201fb1d974a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:2744
        • C:\Users\Admin\AppData\Local\Temp\C5B0.exe
          "C:\Users\Admin\AppData\Local\Temp\C5B0.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2768
          • C:\Users\Admin\AppData\Local\Temp\C5B0.exe
            "C:\Users\Admin\AppData\Local\Temp\C5B0.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1108
            • C:\Users\Admin\AppData\Local\261f13b5-b337-4022-92cf-8fe97e67d1de\build3.exe
              "C:\Users\Admin\AppData\Local\261f13b5-b337-4022-92cf-8fe97e67d1de\build3.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:624
              • C:\Users\Admin\AppData\Local\261f13b5-b337-4022-92cf-8fe97e67d1de\build3.exe
                "C:\Users\Admin\AppData\Local\261f13b5-b337-4022-92cf-8fe97e67d1de\build3.exe"
                6⤵
                • Executes dropped EXE
                PID:3032
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  7⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:1704
    • C:\Users\Admin\AppData\Local\Temp\1853.exe
      C:\Users\Admin\AppData\Local\Temp\1853.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 124
        2⤵
        • Loads dropped DLL
        • Program crash
        PID:3040
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\2EA2.bat" "
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\system32\reg.exe
        reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
        2⤵
          PID:1684
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {DE2F7849-DC45-43BB-B811-688E160F95D2} S-1-5-21-406356229-2805545415-1236085040-1000:IKJSPGIM\Admin:Interactive:[1]
        1⤵
          PID:1880
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2816
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              3⤵
              • Executes dropped EXE
              PID:2516
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                4⤵
                • DcRat
                • Creates scheduled task(s)
                PID:2632
          • C:\Users\Admin\AppData\Roaming\hwiteje
            C:\Users\Admin\AppData\Roaming\hwiteje
            2⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: MapViewOfSection
            PID:2156
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2492
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              3⤵
              • Executes dropped EXE
              PID:744
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2252
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              3⤵
              • Executes dropped EXE
              PID:1052
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1740
            • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
              3⤵
              • Executes dropped EXE
              PID:812
        • C:\Users\Admin\AppData\Local\Temp\D482.exe
          C:\Users\Admin\AppData\Local\Temp\D482.exe
          1⤵
          • Executes dropped EXE
          PID:1576
        • C:\Users\Admin\AppData\Local\Temp\5063.exe
          C:\Users\Admin\AppData\Local\Temp\5063.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2480
          • C:\Users\Admin\AppData\Local\Temp\5063.exe
            "C:\Users\Admin\AppData\Local\Temp\5063.exe"
            2⤵
            • Windows security bypass
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            PID:892
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              3⤵
                PID:624
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  4⤵
                  • Modifies Windows Firewall
                  • Modifies data under HKEY_USERS
                  PID:1072
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                3⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Manipulates WinMon driver.
                • Manipulates WinMonFS driver.
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                PID:1904
                • C:\Windows\system32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  4⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:2672
                • C:\Windows\system32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  4⤵
                    PID:2664
                  • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                    "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Modifies system certificate store
                    PID:2448
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1552
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2336
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2972
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1980
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:552
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2644
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2880
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1892
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2676
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2156
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2440
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -timeout 0
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1096
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                      5⤵
                      • Modifies boot configuration data using bcdedit
                      PID:2432
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    4⤵
                    • Executes dropped EXE
                    PID:992
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\Sysnative\bcdedit.exe /v
                    4⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2696
                  • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                    4⤵
                    • Executes dropped EXE
                    PID:2196
                  • C:\Windows\system32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    4⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:1264
                  • C:\Windows\windefender.exe
                    "C:\Windows\windefender.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:2652
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      5⤵
                        PID:2736
                        • C:\Windows\SysWOW64\sc.exe
                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          6⤵
                          • Launches sc.exe
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1800
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies Installed Components in the registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1496
              • C:\Windows\system32\makecab.exe
                "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240329015037.log C:\Windows\Logs\CBS\CbsPersist_20240329015037.cab
                1⤵
                • Drops file in Windows directory
                PID:2892
              • C:\Windows\windefender.exe
                C:\Windows\windefender.exe
                1⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                PID:1644

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              Scheduled Task/Job

              1
              T1053

              Persistence

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Privilege Escalation

              Boot or Logon Autostart Execution

              2
              T1547

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Defense Evasion

              Impair Defenses

              4
              T1562

              Disable or Modify Tools

              2
              T1562.001

              Disable or Modify System Firewall

              1
              T1562.004

              Modify Registry

              5
              T1112

              File and Directory Permissions Modification

              1
              T1222

              Subvert Trust Controls

              1
              T1553

              Install Root Certificate

              1
              T1553.004

              Credential Access

              Discovery

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              Peripheral Device Discovery

              1
              T1120

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Web Service

              1
              T1102

              Impact

              Resource Development

              Reconnaissance

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                Filesize

                1KB

                MD5

                2a789d6b366b95c47c2e68c27f863f81

                SHA1

                1b123bd94179f5b8746bc960691ddb9546855e05

                SHA256

                ba4990d90cdd27ce932e39c10e178659436aeb5a290faa47f4825da9eca6bc94

                SHA512

                027180aabc65ae3ca35f83161b11d289d87af854656483ac2cf703d94f695c4d5bce0fce1901278ab4cbfc985c9b9aa1f455c889913834c4b1734a365c7f8e3b

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                Filesize

                68KB

                MD5

                29f65ba8e88c063813cc50a4ea544e93

                SHA1

                05a7040d5c127e68c25d81cc51271ffb8bef3568

                SHA256

                1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                SHA512

                e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                Filesize

                724B

                MD5

                8202a1cd02e7d69597995cabbe881a12

                SHA1

                8858d9d934b7aa9330ee73de6c476acf19929ff6

                SHA256

                58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                SHA512

                97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                Filesize

                1KB

                MD5

                a266bb7dcc38a562631361bbf61dd11b

                SHA1

                3b1efd3a66ea28b16697394703a72ca340a05bd5

                SHA256

                df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                SHA512

                0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                Filesize

                410B

                MD5

                787623b2673cfa1762f0f4f68024322a

                SHA1

                0c2c723b45881038d7133ee7bf730277d08f2489

                SHA256

                608b971c0259def6062360f3781af36d7d2678c14a749d234e4d2248bf1e71c5

                SHA512

                5574dcc63670b87a901471248f191876926a3b3492b8f03e92311a7fd2770c6bae0673448fec60786ee359124762fe77df973b9ea9aa2407dbd75819fcf85e74

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                Filesize

                344B

                MD5

                4919eb4a31876e8ff7a5b00597d5c9aa

                SHA1

                2b060ee98d1f1b31280a9dba126ad2838ac855de

                SHA256

                d8b472dfdb95b68fb9aaf87e755d501822ee0f308b39268c1dc6451018aa69d7

                SHA512

                213f12556380d7d248ecc68f7ef005c9841464366e09ed6e96a0b7c0c259f2715f0e9f57245cc1dc2874914bdc77e50e483d9a729354878a07e494c5367aafd9

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                Filesize

                344B

                MD5

                ccb0fb925718ae4b8bbeeae1d62e04a0

                SHA1

                21fa3cb5e27d72b16f1b96d99e05fc4d78ae706f

                SHA256

                4781847b8a473758e52211e78e779cc1e89f4cf7301e475022e753ce304b7788

                SHA512

                6d2e5d11537002cd15b852daffe3cd2c70346706ed3b93128daa6bc7511e17ad272ea2d01efaf035120113ebac1cdca5e3da46ec21bab6d8ee646cbc386132ef

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                Filesize

                344B

                MD5

                77c979fe8881358cbcac425ce7493820

                SHA1

                c16470a85c85eed9db16c3d9afe25ba7c5ef61b9

                SHA256

                904152d9dddb8e60f42ff453fd4a8f738c776dd772a4516256249e3d515a3246

                SHA512

                cf67701de98ff809a301f735bce841a5ac3a48f4970db552b3d5f5cf1e274e2f48c6efe15069aaf8b8f146b399f48ec671d0cfcbf7a91b72760bf2fad27866c9

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                Filesize

                392B

                MD5

                37df07198d22f65c0b4e21e886923e09

                SHA1

                29e5edcfd32c99d664085d99af0cd3a1eb8242e5

                SHA256

                300c35a10be339714fe16b1166cf366c84709acc95631220657f0c9fe17d5a9f

                SHA512

                bd26668238732d30a9918c493e29a5e179f9b5ae65e9f6a1aa733e974ba7ef4459d1d21836c608fc8c111d0602265d219ddd644a5e065f7b35cb47ea70af813e

                Download Submit
              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                Filesize

                242B

                MD5

                1a07f838b7b4e7dddb8f7adde9998650

                SHA1

                5ce115db50ab46b1cc0557cc0c605c6634f52105

                SHA256

                559fac1a6efc8f4c0bdb5b888c312fe5d843d5f6a48565f8b18a49e1c115e3e5

                SHA512

                8c07cb584a09fe8b4494ce4edb528bca1e0221ae061651dbe275277298f22a48d5f418ff19f40d331a663b10132455722212252cde2621921a05b3b3138dd9d2

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\1853.exe
                Filesize

                6.5MB

                MD5

                9e52aa572f0afc888c098db4c0f687ff

                SHA1

                ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                SHA256

                4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                SHA512

                d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\5063.exe
                Filesize

                4.1MB

                MD5

                e445c438749eab1cc57d98407a83875a

                SHA1

                4b67b8f084aaf3a7a89534b32beab4e5faef674d

                SHA256

                f5cb5ace2b7d35f46c14eb827cf041dba371d5b9b9c8c7ef8ca4af01faebab37

                SHA512

                1e338586df2dcf4a77f9605860e18c5feb6f0cdabf7165877a53996af944aac361a4ca1faa2cce791a0d1336458965888d05af495bb6e2faac6031ed3cd160d4

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\B2BC.bat
                Filesize

                77B

                MD5

                55cc761bf3429324e5a0095cab002113

                SHA1

                2cc1ef4542a4e92d4158ab3978425d517fafd16d

                SHA256

                d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                SHA512

                33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\C5B0.exe
                Filesize

                759KB

                MD5

                8fc47a2e0522045212012582f2a93237

                SHA1

                1d32e4ca7f3dba186a6b51c8b6b3d35fc33d76a4

                SHA256

                3446214e3bc72a5c67cdc3caed85f1611133fe4dad33fc398ab6d4402d3aa20c

                SHA512

                c6c35796ab378aff8437da960675d45c189eb09546cdfc8a5701be7275004b2d13fd38f695f92f17a783697236c054a7e64da9ea771e233dbcb1c6abb0cd52ef

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\CabD5F5.tmp
                Filesize

                65KB

                MD5

                ac05d27423a85adc1622c714f2cb6184

                SHA1

                b0fe2b1abddb97837ea0195be70ab2ff14d43198

                SHA256

                c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                SHA512

                6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                Filesize

                492KB

                MD5

                fafbf2197151d5ce947872a4b0bcbe16

                SHA1

                a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                SHA256

                feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                SHA512

                acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\TarE621.tmp
                Filesize

                171KB

                MD5

                9c0c641c06238516f27941aa1166d427

                SHA1

                64cd549fb8cf014fcd9312aa7a5b023847b6c977

                SHA256

                4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                SHA512

                936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\TarF276.tmp
                Filesize

                177KB

                MD5

                435a9ac180383f9fa094131b173a2f7b

                SHA1

                76944ea657a9db94f9a4bef38f88c46ed4166983

                SHA256

                67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                SHA512

                1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                Filesize

                281KB

                MD5

                d98e33b66343e7c96158444127a117f6

                SHA1

                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                SHA256

                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                SHA512

                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                Filesize

                591KB

                MD5

                e2f68dc7fbd6e0bf031ca3809a739346

                SHA1

                9c35494898e65c8a62887f28e04c0359ab6f63f5

                SHA256

                b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                SHA512

                26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                Download Submit
              • C:\Users\Admin\AppData\Roaming\hwiteje
                Filesize

                294KB

                MD5

                5700c54d51e14d0ce00bbbb6015baed2

                SHA1

                71eb9361a9d6b35317fc8a385b748a8a6ce3bee7

                SHA256

                583d73f0111e0aeed0a34fa4fc4ba85875a11f88ac93f9bacb59359aaf5b94e2

                SHA512

                9dddd66cf82aead6400a19e81ccd0ebc0f5e312bc5772937e1929820a1db0fb74cf1480ef3bb9e9c70aefa25ce02c8c7d9f1a17bff6eb2137d76247a61eb2b9d

                Download Submit
              • C:\Windows\windefender.exe
                Filesize

                2.0MB

                MD5

                8e67f58837092385dcf01e8a2b4f5783

                SHA1

                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                SHA256

                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                SHA512

                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                Download Submit
              • \Users\Admin\AppData\Local\261f13b5-b337-4022-92cf-8fe97e67d1de\build3.exe
                Filesize

                299KB

                MD5

                41b883a061c95e9b9cb17d4ca50de770

                SHA1

                1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                SHA256

                fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                SHA512

                cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                Download Submit
              • \Users\Admin\AppData\Local\Temp\D482.exe
                Filesize

                30.6MB

                MD5

                ff35671d54d612772b0c22c141a3056e

                SHA1

                d005a27cd48556bf17eb9c2b43af49b67347cc0e

                SHA256

                2f625ea35f82332c639049c4a849f39cd2b74acb013880d156a2f647497c2512

                SHA512

                9a40a657f196036ef07c410db225f7a023f7299abc078cefd5d97489e7359ce9c640d72b98fedbf3f11ebaba1987b0acd5c7892b1ba5b5ae18709037df45790e

                Download Submit
              • \Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                Filesize

                94KB

                MD5

                d98e78fd57db58a11f880b45bb659767

                SHA1

                ab70c0d3bd9103c07632eeecee9f51d198ed0e76

                SHA256

                414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0

                SHA512

                aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831

                Download Submit
              • \Users\Admin\AppData\Local\Temp\csrss\patch.exe
                Filesize

                1.7MB

                MD5

                13aaafe14eb60d6a718230e82c671d57

                SHA1

                e039dd924d12f264521b8e689426fb7ca95a0a7b

                SHA256

                f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                SHA512

                ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                Download Submit
              • \Users\Admin\AppData\Local\Temp\dbghelp.dll
                Filesize

                1.5MB

                MD5

                f0616fa8bc54ece07e3107057f74e4db

                SHA1

                b33995c4f9a004b7d806c4bb36040ee844781fca

                SHA256

                6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

                SHA512

                15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

                Download Submit
              • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                Filesize

                5.3MB

                MD5

                1afff8d5352aecef2ecd47ffa02d7f7d

                SHA1

                8b115b84efdb3a1b87f750d35822b2609e665bef

                SHA256

                c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                SHA512

                e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                Download Submit
              • \Users\Admin\AppData\Local\Temp\symsrv.dll
                Filesize

                163KB

                MD5

                5c399d34d8dc01741269ff1f1aca7554

                SHA1

                e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                SHA256

                e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                SHA512

                8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                Download Submit
              • memory/624-168-0x00000000003A0000-0x00000000003A4000-memory.dmp
                Filesize

                16KB

                Download
              • memory/624-166-0x0000000000230000-0x0000000000330000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/892-321-0x0000000000400000-0x0000000000ECD000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/892-322-0x0000000002770000-0x0000000002B68000-memory.dmp
                Filesize

                4.0MB

                Download
              • memory/892-308-0x0000000002770000-0x0000000002B68000-memory.dmp
                Filesize

                4.0MB

                Download
              • memory/892-309-0x0000000002B70000-0x000000000345B000-memory.dmp
                Filesize

                8.9MB

                Download
              • memory/892-310-0x0000000000400000-0x0000000000ECD000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/1108-83-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1108-87-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1108-89-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1108-90-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1108-161-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1108-91-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1108-82-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1108-68-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1108-69-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/1244-4-0x0000000002980000-0x0000000002996000-memory.dmp
                Filesize

                88KB

                Download
              • memory/1496-426-0x00000000041F0000-0x00000000041F1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1496-326-0x00000000041F0000-0x00000000041F1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1644-519-0x0000000000400000-0x00000000008DF000-memory.dmp
                Filesize

                4.9MB

                Download
              • memory/1644-534-0x0000000000400000-0x00000000008DF000-memory.dmp
                Filesize

                4.9MB

                Download
              • memory/1740-531-0x0000000000950000-0x0000000000A50000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/1904-413-0x0000000000400000-0x0000000000ECD000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/1904-324-0x0000000000400000-0x0000000000ECD000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/1904-323-0x0000000002780000-0x0000000002B78000-memory.dmp
                Filesize

                4.0MB

                Download
              • memory/1992-130-0x0000000000180000-0x0000000000181000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-104-0x0000000000080000-0x0000000000081000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-135-0x0000000000190000-0x0000000000191000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-102-0x0000000000080000-0x0000000000081000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-105-0x0000000000850000-0x0000000001535000-memory.dmp
                Filesize

                12.9MB

                Download
              • memory/1992-133-0x0000000000850000-0x0000000001535000-memory.dmp
                Filesize

                12.9MB

                Download
              • memory/1992-132-0x0000000000180000-0x0000000000181000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-127-0x0000000000170000-0x0000000000171000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-175-0x0000000000850000-0x0000000001535000-memory.dmp
                Filesize

                12.9MB

                Download
              • memory/1992-125-0x0000000000170000-0x0000000000171000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-122-0x0000000000160000-0x0000000000161000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-120-0x0000000000160000-0x0000000000161000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-107-0x0000000000080000-0x0000000000081000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-97-0x0000000000850000-0x0000000001535000-memory.dmp
                Filesize

                12.9MB

                Download
              • memory/1992-110-0x0000000000090000-0x0000000000091000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-108-0x0000000000090000-0x0000000000091000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-112-0x0000000000090000-0x0000000000091000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-115-0x00000000000A0000-0x00000000000A1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1992-117-0x00000000000A0000-0x00000000000A1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2156-216-0x0000000000400000-0x0000000000AF2000-memory.dmp
                Filesize

                6.9MB

                Download
              • memory/2156-188-0x0000000000C00000-0x0000000000D00000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/2156-189-0x0000000000400000-0x0000000000AF2000-memory.dmp
                Filesize

                6.9MB

                Download
              • memory/2252-468-0x0000000000970000-0x0000000000A70000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/2252-486-0x0000000000970000-0x0000000000A70000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/2352-2-0x0000000000220000-0x000000000022B000-memory.dmp
                Filesize

                44KB

                Download
              • memory/2352-3-0x0000000000400000-0x0000000000AF2000-memory.dmp
                Filesize

                6.9MB

                Download
              • memory/2352-1-0x0000000000F40000-0x0000000001040000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/2352-5-0x0000000000400000-0x0000000000AF2000-memory.dmp
                Filesize

                6.9MB

                Download
              • memory/2448-335-0x0000000140000000-0x00000001405E8000-memory.dmp
                Filesize

                5.9MB

                Download
              • memory/2448-353-0x0000000140000000-0x00000001405E8000-memory.dmp
                Filesize

                5.9MB

                Download
              • memory/2480-291-0x0000000002780000-0x0000000002B78000-memory.dmp
                Filesize

                4.0MB

                Download
              • memory/2480-306-0x0000000002780000-0x0000000002B78000-memory.dmp
                Filesize

                4.0MB

                Download
              • memory/2480-292-0x0000000002B80000-0x000000000346B000-memory.dmp
                Filesize

                8.9MB

                Download
              • memory/2480-293-0x0000000000400000-0x0000000000ECD000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/2480-305-0x0000000002B80000-0x000000000346B000-memory.dmp
                Filesize

                8.9MB

                Download
              • memory/2480-307-0x0000000000400000-0x0000000000ECD000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/2492-434-0x00000000002D0000-0x00000000003D0000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/2520-58-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/2520-37-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/2520-36-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/2520-33-0x0000000000400000-0x0000000000537000-memory.dmp
                Filesize

                1.2MB

                Download
              • memory/2520-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2652-518-0x0000000000400000-0x00000000008DF000-memory.dmp
                Filesize

                4.9MB

                Download
              • memory/2652-521-0x0000000000400000-0x00000000008DF000-memory.dmp
                Filesize

                4.9MB

                Download
              • memory/2768-60-0x00000000002E0000-0x0000000000372000-memory.dmp
                Filesize

                584KB

                Download
              • memory/2768-62-0x00000000002E0000-0x0000000000372000-memory.dmp
                Filesize

                584KB

                Download
              • memory/2816-195-0x00000000009A0000-0x0000000000AA0000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/2944-28-0x0000000002440000-0x000000000255B000-memory.dmp
                Filesize

                1.1MB

                Download
              • memory/2944-27-0x00000000002E0000-0x0000000000372000-memory.dmp
                Filesize

                584KB

                Download
              • memory/2944-26-0x00000000002E0000-0x0000000000372000-memory.dmp
                Filesize

                584KB

                Download
              • memory/3032-176-0x0000000000400000-0x0000000000406000-memory.dmp
                Filesize

                24KB

                Download