Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29-03-2024 01:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e6cf2ae79432017ed234aa7d595ebcf4934f8955223518d2a5ea7eefc8d83afd.exe

  • Size

    311KB

  • MD5

    3d7dd2b2871160b365b94480b15b9ac5

  • SHA1

    a081bf4469537ac9b30e6e55fac4021833a5fe56

  • SHA256

    e6cf2ae79432017ed234aa7d595ebcf4934f8955223518d2a5ea7eefc8d83afd

  • SHA512

    dd0b03fc18ae326a0853f30b34479e6e0fa37c10ce97798188ffaab394ff23180009be267d856c7f4e00f957e6d3d3ac44f5537c13979b714ae2ed48cd91b4a3

  • SSDEEP

    3072:ETDj0SvvDbjVf4m+N0iXfsHF96XU5Q2YYoAkRrGcdfv11b1dkFjTmc:Efj9ZKfE6YQ2YYcR60H1dkFjT

Score
10/10
dcratdjvugluptebalummaredlinesmokeloadervidar5739ef2bbcd39fcd59c5746bfe4238c5logsdiller cloud (tg: @logsdillabot)pub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.6

Botnet

5739ef2bbcd39fcd59c5746bfe4238c5

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok
Attributes
  • profile_id_v2

    5739ef2bbcd39fcd59c5746bfe4238c5

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.0:29587

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://affordcharmcropwo.shop/api

Signatures

  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Vidar Stealer 5 IoCs
    stealer
  • Detected Djvu ransomware 16 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 26 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 58 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 49 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6cf2ae79432017ed234aa7d595ebcf4934f8955223518d2a5ea7eefc8d83afd.exe
    "C:\Users\Admin\AppData\Local\Temp\e6cf2ae79432017ed234aa7d595ebcf4934f8955223518d2a5ea7eefc8d83afd.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4772
  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\B9EA.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:4732
    • C:\Users\Admin\AppData\Local\Temp\C891.exe
      C:\Users\Admin\AppData\Local\Temp\C891.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3324
      • C:\Users\Admin\AppData\Local\Temp\C891.exe
        C:\Users\Admin\AppData\Local\Temp\C891.exe
        2⤵
        • DcRat
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\d6e915b2-6efc-4eca-a397-e33c282a3a9e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:4704
        • C:\Users\Admin\AppData\Local\Temp\C891.exe
          "C:\Users\Admin\AppData\Local\Temp\C891.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\Users\Admin\AppData\Local\Temp\C891.exe
            "C:\Users\Admin\AppData\Local\Temp\C891.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1084
            • C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build2.exe
              "C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build2.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1420
              • C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build2.exe
                "C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build2.exe"
                6⤵
                • Executes dropped EXE
                PID:3592
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3592 -s 1920
                  7⤵
                  • Program crash
                  PID:684
            • C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build3.exe
              "C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build3.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1872
              • C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build3.exe
                "C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build3.exe"
                6⤵
                • Executes dropped EXE
                PID:2400
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  7⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:3840
    • C:\Users\Admin\AppData\Local\Temp\DE2D.exe
      C:\Users\Admin\AppData\Local\Temp\DE2D.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:500
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 500 -s 820
        2⤵
        • Program crash
        PID:3456
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:4712
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        PID:2632
        • C:\Windows\SysWOW64\schtasks.exe
          /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
          3⤵
          • DcRat
          • Creates scheduled task(s)
          PID:1980
    • C:\Users\Admin\AppData\Local\Temp\946E.exe
      C:\Users\Admin\AppData\Local\Temp\946E.exe
      1⤵
      • Executes dropped EXE
      PID:4272
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\96F0.bat" "
      1⤵
        PID:1668
        • C:\Windows\system32\reg.exe
          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
          2⤵
            PID:2068
        • C:\Users\Admin\AppData\Local\Temp\E138.exe
          C:\Users\Admin\AppData\Local\Temp\E138.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:3832
          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            2⤵
              PID:4440
          • C:\Users\Admin\AppData\Local\Temp\22E6.exe
            C:\Users\Admin\AppData\Local\Temp\22E6.exe
            1⤵
            • Executes dropped EXE
            PID:2520
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3736
            • C:\Users\Admin\AppData\Local\Temp\22E6.exe
              "C:\Users\Admin\AppData\Local\Temp\22E6.exe"
              2⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:4072
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                3⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:4408
              • C:\Windows\System32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                3⤵
                  PID:3324
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:4024
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  3⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:996
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  3⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:60
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  3⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Manipulates WinMonFS driver.
                  • Drops file in Windows directory
                  PID:2060
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:3544
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    4⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:3916
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    4⤵
                      PID:3920
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:1724
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      PID:4492
                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                      4⤵
                      • Executes dropped EXE
                      PID:1720
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      4⤵
                      • DcRat
                      • Creates scheduled task(s)
                      PID:368
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:4200
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        5⤵
                          PID:3904
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            6⤵
                            • Launches sc.exe
                            PID:4272
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:956
                • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                  1⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:1296
                • C:\Users\Admin\AppData\Roaming\rcgdrfd
                  C:\Users\Admin\AppData\Roaming\rcgdrfd
                  1⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: MapViewOfSection
                  PID:3300
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:3828
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    2⤵
                    • Executes dropped EXE
                    PID:2944
                • C:\Windows\windefender.exe
                  C:\Windows\windefender.exe
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:1384
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Enumerates connected drives
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1852
                • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                  1⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:3536
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2416
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    2⤵
                    • Executes dropped EXE
                    PID:2384
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2276
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    2⤵
                    • Executes dropped EXE
                    PID:3564

                Network

                MITRE ATT&CK Matrix ATT&CK v13

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Defense Evasion

                Impair Defenses

                3
                T1562

                Disable or Modify Tools

                2
                T1562.001

                Disable or Modify System Firewall

                1
                T1562.004

                Modify Registry

                5
                T1112

                File and Directory Permissions Modification

                1
                T1222

                Credential Access

                Unsecured Credentials

                3
                T1552

                Credentials In Files

                3
                T1552.001

                Discovery

                Query Registry

                5
                T1012

                Peripheral Device Discovery

                2
                T1120

                System Information Discovery

                5
                T1082

                Lateral Movement

                Collection

                Data from Local System

                3
                T1005

                Exfiltration

                Command and Control

                Web Service

                1
                T1102

                Impact

                Resource Development

                Reconnaissance

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                  Filesize

                  1KB

                  MD5

                  2a789d6b366b95c47c2e68c27f863f81

                  SHA1

                  1b123bd94179f5b8746bc960691ddb9546855e05

                  SHA256

                  ba4990d90cdd27ce932e39c10e178659436aeb5a290faa47f4825da9eca6bc94

                  SHA512

                  027180aabc65ae3ca35f83161b11d289d87af854656483ac2cf703d94f695c4d5bce0fce1901278ab4cbfc985c9b9aa1f455c889913834c4b1734a365c7f8e3b

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                  Filesize

                  724B

                  MD5

                  8202a1cd02e7d69597995cabbe881a12

                  SHA1

                  8858d9d934b7aa9330ee73de6c476acf19929ff6

                  SHA256

                  58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                  SHA512

                  97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                  Filesize

                  410B

                  MD5

                  bd5e61cd49b997c6967745bcf74244b2

                  SHA1

                  51ffae4bee5d6547b622bb718d2dfc9d5d7b905b

                  SHA256

                  d9d788cf2f09c9865f35b04a74b0be3adb7ab6befbdb09d9ee4325096502dd3b

                  SHA512

                  8e4496594c3528597977cb5b73391a6cfdde67b363d2a7e7b090a2f6f34b20cc4f6190050af8fc7ebb64392072e8760664584e6c8abd2d93fefea3ec7908b70f

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                  Filesize

                  392B

                  MD5

                  9c6ea800ebd4edc3238663e99c38e76c

                  SHA1

                  4bbcfbde9830f50fb2444a033ccb6ea229a3f394

                  SHA256

                  bdbf72e5811569251faa17f9174bc6cf01d0d86bb192598b2f6a7d8525a0725b

                  SHA512

                  1b49ed0baccecceb6631c2cf91df0661fedb5158dfc8ec5becb3e8f2be230a1ee5609b54f783a8b36cfbef04a67ec31e7989236f9a4610c0ac48b01b59010170

                  Download Submit
                • C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build2.exe
                  Filesize

                  277KB

                  MD5

                  8dae8b6a6be6e3527183594d1c26a2d3

                  SHA1

                  b87e40cee60869a36e79c88c8a3a34baf0bc4889

                  SHA256

                  afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

                  SHA512

                  0bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e

                  Download Submit
                • C:\Users\Admin\AppData\Local\4e67e1eb-04a9-476a-83a0-9f77aa33e86c\build3.exe
                  Filesize

                  299KB

                  MD5

                  41b883a061c95e9b9cb17d4ca50de770

                  SHA1

                  1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                  SHA256

                  fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                  SHA512

                  cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                  Download Submit
                • C:\Users\Admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
                  Filesize

                  985B

                  MD5

                  44c50d3402b6dad7f3be7777109f18c3

                  SHA1

                  933924b9cb0915cd67d9d28fc45ea6fea17bb386

                  SHA256

                  2907e29ec838471b86d13125e8847fc859eacc11d506513787a52e5fdb45e5c9

                  SHA512

                  cfacca5eaec918a4cb8cba4ebbcd2782bce573cdcbd02cb37b845c15c1e05cc8f558a8f5327b9d64ac149f623b05ddf7ef618dc658988004dc0897729952d421

                  Download Submit
                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8CJ1AR61\microsoft.windows[1].xml
                  Filesize

                  97B

                  MD5

                  de200f323ae76d0009389dff6ae07446

                  SHA1

                  3169fc9e2b9300231271e245dad6ba67d6d4cae9

                  SHA256

                  f71cc4c5168a3f95056d609e533a1a4b9dfb9b7b25e9148c277bfe30b774b1e8

                  SHA512

                  0cc679490077edf659793e224f2f16bb995189347bd7faaec2b69ac00a7e0c6bb114d85adf86e7eeeb938cf4d35bf484dde775dd947f3241b10249401f64174e

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\22E6.exe
                  Filesize

                  4.1MB

                  MD5

                  e445c438749eab1cc57d98407a83875a

                  SHA1

                  4b67b8f084aaf3a7a89534b32beab4e5faef674d

                  SHA256

                  f5cb5ace2b7d35f46c14eb827cf041dba371d5b9b9c8c7ef8ca4af01faebab37

                  SHA512

                  1e338586df2dcf4a77f9605860e18c5feb6f0cdabf7165877a53996af944aac361a4ca1faa2cce791a0d1336458965888d05af495bb6e2faac6031ed3cd160d4

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\946E.exe
                  Filesize

                  6.5MB

                  MD5

                  9e52aa572f0afc888c098db4c0f687ff

                  SHA1

                  ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                  SHA256

                  4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                  SHA512

                  d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\B9EA.bat
                  Filesize

                  77B

                  MD5

                  55cc761bf3429324e5a0095cab002113

                  SHA1

                  2cc1ef4542a4e92d4158ab3978425d517fafd16d

                  SHA256

                  d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                  SHA512

                  33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\C891.exe
                  Filesize

                  759KB

                  MD5

                  46a230d9be88dd7dca63ab0ec41c0b14

                  SHA1

                  8072cc39226b6b18164eb58a81ce7433fae55c58

                  SHA256

                  59b4a0b07d2a7901e49e8cc55c2eae5b457fde6e8b25295374a3e4ee37e207b5

                  SHA512

                  8c21b6c8f33608e47ead31e1e731a7cd4791d53a05f4574143156f067669a4ced8b48ffcd4f13f5d9cf9eb63dfa7873d8f491b4a02e05370fd03ca210adf9a28

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\DE2D.exe
                  Filesize

                  392KB

                  MD5

                  89ec2c6bf09ed9a38bd11acb2a41cd1b

                  SHA1

                  408549982b687ca8dd5efb0e8b704a374bd8909d

                  SHA256

                  da1e155c46ca6b23409d059b6d85341c0b86c92d2c69dbda85eef3894313662d

                  SHA512

                  c565dbb25dd35ae8dce2a4cf15640053aca8b99c5c78db23648e6618ef316362b77142c6524b47089a7ea05632adee091ec5e82ed95aeb86d2331b8c5f8cc56a

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\E138.exe
                  Filesize

                  30.6MB

                  MD5

                  ff35671d54d612772b0c22c141a3056e

                  SHA1

                  d005a27cd48556bf17eb9c2b43af49b67347cc0e

                  SHA256

                  2f625ea35f82332c639049c4a849f39cd2b74acb013880d156a2f647497c2512

                  SHA512

                  9a40a657f196036ef07c410db225f7a023f7299abc078cefd5d97489e7359ce9c640d72b98fedbf3f11ebaba1987b0acd5c7892b1ba5b5ae18709037df45790e

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4hnoo3c3.dw0.ps1
                  Filesize

                  1B

                  MD5

                  c4ca4238a0b923820dcc509a6f75849b

                  SHA1

                  356a192b7913b04c54574d18c28d46e6395428ab

                  SHA256

                  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                  SHA512

                  4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  Filesize

                  281KB

                  MD5

                  d98e33b66343e7c96158444127a117f6

                  SHA1

                  bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                  SHA256

                  5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                  SHA512

                  705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                  Download Submit
                • C:\Users\Admin\AppData\Roaming\rcgdrfd
                  Filesize

                  311KB

                  MD5

                  3d7dd2b2871160b365b94480b15b9ac5

                  SHA1

                  a081bf4469537ac9b30e6e55fac4021833a5fe56

                  SHA256

                  e6cf2ae79432017ed234aa7d595ebcf4934f8955223518d2a5ea7eefc8d83afd

                  SHA512

                  dd0b03fc18ae326a0853f30b34479e6e0fa37c10ce97798188ffaab394ff23180009be267d856c7f4e00f957e6d3d3ac44f5537c13979b714ae2ed48cd91b4a3

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                  Filesize

                  2KB

                  MD5

                  1c19c16e21c97ed42d5beabc93391fc5

                  SHA1

                  8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                  SHA256

                  1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                  SHA512

                  7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  18KB

                  MD5

                  0733b8281350256f3b02f6b509f30119

                  SHA1

                  b96720c410a2e9f151508a8b5f3ccc89262c5173

                  SHA256

                  a5019247f216476870ad75f77e5c314540662255ac4701316cb637bd15547839

                  SHA512

                  151ea3f04fd663b4302c78b7ef38747ab26360764a3b3d9d0a3a3a05cc8d1f207ef8e0491070da937f26080e2c3ea2c1769c6cdb2b7e13de277f3220c27e597a

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  18KB

                  MD5

                  1a10fc7cc25643803fa690f4abd39d83

                  SHA1

                  1e1f172cb433cf1947b240a056e89ef83c43eda1

                  SHA256

                  27b28a961852eefa79d8ddb1238642e4089c12dc09ad493dfbd136bf5167e6ae

                  SHA512

                  c6186e97ee6a3da9d33d1cb554474908305a8a1616beff6e714cabfb8e4191d6cc3336480a0dff08f02985870a21fd52d80d3e3b9ff540d692f21f846432c445

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  18KB

                  MD5

                  dba51f48a20c14111ca19548b10880bc

                  SHA1

                  bf3e8cafdc0f072529d8526ca9d08bb23f1dce5a

                  SHA256

                  21c3f29aea6165edb334cb22ebd85ce60bc866a1742af467b748e006a49722b7

                  SHA512

                  8c1a9c977566d7210176de60c153fd9b2791612ec9f1dc8ac8e93e07de16e1d3e39d838888df7be777ba93837a6a9b3ce7db2e2eee24ca552d6506ad56594d3e

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  18KB

                  MD5

                  30965aa97ebf12049f6e7339c1720269

                  SHA1

                  0ba05c0675a758bc947a2cece0c48d37e73c2ddf

                  SHA256

                  b5a2dd8c3038a219e50ee6698ac4c5b1409010e766aa2510d23a236b331cbdec

                  SHA512

                  38c3817f96894dd122dfaa69e4030fe067e69b653a7a9996bd7fbcfb5c7d05bc440d6d6aa75b9c75040e6b91230bb6ea654c927406b837b7ad7c2c3e70e17058

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  18KB

                  MD5

                  170f20fef7566247acf4f38b38492f55

                  SHA1

                  86469ccad328d9a590ef067737524639c5e08dec

                  SHA256

                  eda6ccd3e07af71c1c0bdd8b41832c87542540eef76c930c210650ceac2bab91

                  SHA512

                  6e3b5c30bc87bd55315ea52ca8f05f1d158d11fe3295e818163079ad33b8d5e5740c2dd74294b065a8d6aac220d645790f77ede643856a5c662829ca039e0791

                  Download Submit
                • C:\Windows\windefender.exe
                  Filesize

                  2.0MB

                  MD5

                  8e67f58837092385dcf01e8a2b4f5783

                  SHA1

                  012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                  SHA256

                  166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                  SHA512

                  40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                  Download Submit
                • memory/500-102-0x0000000003230000-0x0000000005230000-memory.dmp
                  Filesize

                  32.0MB

                  Download
                • memory/500-124-0x0000000003230000-0x0000000005230000-memory.dmp
                  Filesize

                  32.0MB

                  Download
                • memory/500-87-0x00000000030E0000-0x00000000030E1000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/500-86-0x00000000058D0000-0x00000000058E0000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/500-116-0x00000000058D0000-0x00000000058E0000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/500-113-0x0000000072080000-0x000000007276E000-memory.dmp
                  Filesize

                  6.9MB

                  Download
                • memory/500-85-0x0000000072080000-0x000000007276E000-memory.dmp
                  Filesize

                  6.9MB

                  Download
                • memory/500-84-0x0000000000E70000-0x0000000000ED4000-memory.dmp
                  Filesize

                  400KB

                  Download
                • memory/1084-46-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-76-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-44-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-51-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-45-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-97-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-59-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-58-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-56-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1084-52-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1420-72-0x00000000007E0000-0x0000000000811000-memory.dmp
                  Filesize

                  196KB

                  Download
                • memory/1420-71-0x0000000000870000-0x0000000000970000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/1436-38-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1436-24-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1436-21-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1436-25-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1436-26-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1872-122-0x00000000001E0000-0x00000000001E4000-memory.dmp
                  Filesize

                  16KB

                  Download
                • memory/1872-121-0x0000000000929000-0x000000000093A000-memory.dmp
                  Filesize

                  68KB

                  Download
                • memory/2400-123-0x0000000000400000-0x0000000000406000-memory.dmp
                  Filesize

                  24KB

                  Download
                • memory/2400-128-0x0000000000410000-0x00000000004D5000-memory.dmp
                  Filesize

                  788KB

                  Download
                • memory/2400-118-0x0000000000400000-0x0000000000406000-memory.dmp
                  Filesize

                  24KB

                  Download
                • memory/2400-127-0x0000000000400000-0x0000000000406000-memory.dmp
                  Filesize

                  24KB

                  Download
                • memory/3296-4-0x00000000011E0000-0x00000000011F6000-memory.dmp
                  Filesize

                  88KB

                  Download
                • memory/3324-20-0x0000000002780000-0x000000000281B000-memory.dmp
                  Filesize

                  620KB

                  Download
                • memory/3324-22-0x0000000002860000-0x000000000297B000-memory.dmp
                  Filesize

                  1.1MB

                  Download
                • memory/3592-68-0x0000000000400000-0x0000000000644000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/3592-112-0x0000000000400000-0x0000000000644000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/3592-74-0x0000000000400000-0x0000000000644000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/3592-73-0x0000000000400000-0x0000000000644000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/3832-370-0x00007FF710A50000-0x00007FF71299C000-memory.dmp
                  Filesize

                  31.3MB

                  Download
                • memory/4100-108-0x0000000005190000-0x00000000051CE000-memory.dmp
                  Filesize

                  248KB

                  Download
                • memory/4100-126-0x0000000072080000-0x000000007276E000-memory.dmp
                  Filesize

                  6.9MB

                  Download
                • memory/4100-132-0x0000000007320000-0x000000000784C000-memory.dmp
                  Filesize

                  5.2MB

                  Download
                • memory/4100-131-0x0000000006C20000-0x0000000006DE2000-memory.dmp
                  Filesize

                  1.8MB

                  Download
                • memory/4100-134-0x0000000072080000-0x000000007276E000-memory.dmp
                  Filesize

                  6.9MB

                  Download
                • memory/4100-106-0x0000000005820000-0x000000000592A000-memory.dmp
                  Filesize

                  1.0MB

                  Download
                • memory/4100-111-0x00000000059A0000-0x0000000005A06000-memory.dmp
                  Filesize

                  408KB

                  Download
                • memory/4100-109-0x00000000051D0000-0x000000000521B000-memory.dmp
                  Filesize

                  300KB

                  Download
                • memory/4100-90-0x0000000000400000-0x0000000000450000-memory.dmp
                  Filesize

                  320KB

                  Download
                • memory/4100-101-0x0000000004F00000-0x0000000004F92000-memory.dmp
                  Filesize

                  584KB

                  Download
                • memory/4100-100-0x0000000005320000-0x000000000581E000-memory.dmp
                  Filesize

                  5.0MB

                  Download
                • memory/4100-103-0x0000000004EE0000-0x0000000004EEA000-memory.dmp
                  Filesize

                  40KB

                  Download
                • memory/4100-104-0x0000000072080000-0x000000007276E000-memory.dmp
                  Filesize

                  6.9MB

                  Download
                • memory/4100-105-0x0000000005E30000-0x0000000006436000-memory.dmp
                  Filesize

                  6.0MB

                  Download
                • memory/4100-130-0x0000000006A00000-0x0000000006A50000-memory.dmp
                  Filesize

                  320KB

                  Download
                • memory/4100-107-0x0000000005130000-0x0000000005142000-memory.dmp
                  Filesize

                  72KB

                  Download
                • memory/4272-179-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-189-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-167-0x0000000002F40000-0x0000000002F80000-memory.dmp
                  Filesize

                  256KB

                  Download
                • memory/4272-168-0x0000000002F40000-0x0000000002F80000-memory.dmp
                  Filesize

                  256KB

                  Download
                • memory/4272-174-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-176-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-175-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-177-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-165-0x0000000002F40000-0x0000000002F80000-memory.dmp
                  Filesize

                  256KB

                  Download
                • memory/4272-178-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-180-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-182-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-183-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-181-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-184-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-185-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-186-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-187-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-188-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-166-0x0000000002F40000-0x0000000002F80000-memory.dmp
                  Filesize

                  256KB

                  Download
                • memory/4272-190-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-192-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-191-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-193-0x0000000003000000-0x0000000003001000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-164-0x0000000002F40000-0x0000000002F80000-memory.dmp
                  Filesize

                  256KB

                  Download
                • memory/4272-163-0x0000000002F40000-0x0000000002F41000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-157-0x0000000000C00000-0x0000000000C01000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-158-0x0000000000C30000-0x0000000001915000-memory.dmp
                  Filesize

                  12.9MB

                  Download
                • memory/4272-160-0x0000000000C20000-0x0000000000C21000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-161-0x0000000002F30000-0x0000000002F31000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-159-0x0000000000C10000-0x0000000000C11000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-156-0x00000000003F0000-0x00000000003F1000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-155-0x00000000003D0000-0x00000000003D1000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/4272-146-0x0000000000C30000-0x0000000001915000-memory.dmp
                  Filesize

                  12.9MB

                  Download
                • memory/4432-41-0x00000000026B0000-0x0000000002744000-memory.dmp
                  Filesize

                  592KB

                  Download
                • memory/4772-1-0x0000000000D20000-0x0000000000E20000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/4772-5-0x0000000000400000-0x0000000000AF7000-memory.dmp
                  Filesize

                  7.0MB

                  Download
                • memory/4772-3-0x0000000000400000-0x0000000000AF7000-memory.dmp
                  Filesize

                  7.0MB

                  Download
                • memory/4772-2-0x0000000000B60000-0x0000000000B6B000-memory.dmp
                  Filesize

                  44KB

                  Download