Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    286s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    01-04-2024 04:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe

  • Size

    203KB

  • MD5

    2c4aebcc97030695e4eae570e2aa1f1a

  • SHA1

    b43be65cd79153d07a8959d06583a87650c59699

  • SHA256

    44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452

  • SHA512

    fa99384bc9b5ccb21f0859576d3a420ad6118849fe2892c53e7782096a14d3b9ceb86fb528ce362612d131194c5562ba57190315359e2573564bb2267297f8ee

  • SSDEEP

    3072:bKIdo3wKvh4ZsXLK0aWcfX98+8spxn0bDU+OWJ:bK/3wKvh4ZXnX98Bs3nk

Score
10/10
dcratdjvugluptebasmokeloadervidarpub1backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwareratrootkitstealertrojanupx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .vook

  • offline_id

    1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0857PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

  • DcRat 6 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detect Vidar Stealer 5 IoCs
    stealer
  • Detected Djvu ransomware 14 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 28 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of SetThreadContext 9 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe
    "C:\Users\Admin\AppData\Local\Temp\44d648bfd0f341fb9c9d10a42c0261c7455eb3fbcdd59c93ddad4211b6380452.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3060
  • C:\Windows\system32\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\98A7.bat" "
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
      2⤵
        PID:2412
    • C:\Users\Admin\AppData\Local\Temp\A989.exe
      C:\Users\Admin\AppData\Local\Temp\A989.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Users\Admin\AppData\Local\Temp\A989.exe
        C:\Users\Admin\AppData\Local\Temp\A989.exe
        2⤵
        • DcRat
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\b6be6f83-b1ec-4273-b37d-2d3382d9b898" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          3⤵
          • Modifies file permissions
          PID:2804
        • C:\Users\Admin\AppData\Local\Temp\A989.exe
          "C:\Users\Admin\AppData\Local\Temp\A989.exe" --Admin IsNotAutoStart IsNotTask
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2736
          • C:\Users\Admin\AppData\Local\Temp\A989.exe
            "C:\Users\Admin\AppData\Local\Temp\A989.exe" --Admin IsNotAutoStart IsNotTask
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2824
            • C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build2.exe
              "C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build2.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2724
              • C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build2.exe
                "C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build2.exe"
                6⤵
                • Executes dropped EXE
                • Modifies system certificate store
                • Suspicious use of WriteProcessMemory
                PID:1228
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 1448
                  7⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2624
            • C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build3.exe
              "C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build3.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2020
              • C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build3.exe
                "C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build3.exe"
                6⤵
                • Executes dropped EXE
                PID:2412
                • C:\Windows\SysWOW64\schtasks.exe
                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                  7⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:2440
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {F9B11C1C-0D8A-4148-AF3A-BE321583E7D5} S-1-5-21-3787592910-3720486031-2929222812-1000:HSNHLVYA\Admin:Interactive:[1]
      1⤵
        PID:2388
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:2764
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            3⤵
            • Executes dropped EXE
            PID:2808
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              4⤵
              • DcRat
              • Creates scheduled task(s)
              PID:2404
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:2988
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            3⤵
            • Executes dropped EXE
            PID:2828
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:2564
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            3⤵
            • Executes dropped EXE
            PID:1696
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:3020
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            3⤵
            • Executes dropped EXE
            PID:1976
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:1556
          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
            3⤵
            • Executes dropped EXE
            PID:1784
        • C:\Users\Admin\AppData\Roaming\vuthgur
          C:\Users\Admin\AppData\Roaming\vuthgur
          2⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:1096
      • C:\Users\Admin\AppData\Local\Temp\35F1.exe
        C:\Users\Admin\AppData\Local\Temp\35F1.exe
        1⤵
        • Executes dropped EXE
        PID:2768
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2768 -s 124
          2⤵
          • Loads dropped DLL
          • Program crash
          PID:2276
      • C:\Windows\system32\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\39A9.bat" "
        1⤵
          PID:1808
          • C:\Windows\system32\reg.exe
            reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
            2⤵
              PID:1520
          • C:\Users\Admin\AppData\Local\Temp\58BB.exe
            C:\Users\Admin\AppData\Local\Temp\58BB.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:588
            • C:\Users\Admin\AppData\Local\Temp\58BB.exe
              "C:\Users\Admin\AppData\Local\Temp\58BB.exe"
              2⤵
              • Windows security bypass
              • Executes dropped EXE
              • Loads dropped DLL
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              PID:2460
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                3⤵
                  PID:2400
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    4⤵
                    • Modifies Windows Firewall
                    • Modifies data under HKEY_USERS
                    PID:2392
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  3⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Manipulates WinMon driver.
                  • Manipulates WinMonFS driver.
                  • Drops file in Windows directory
                  • Modifies system certificate store
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2784
                  • C:\Windows\system32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    4⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:2940
                  • C:\Windows\system32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    4⤵
                      PID:1752
                    • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Modifies system certificate store
                      PID:2096
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2264
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2296
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2068
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2912
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:596
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:1036
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2444
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:1544
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:2720
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:924
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:284
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -timeout 0
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:304
                      • C:\Windows\system32\bcdedit.exe
                        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                        5⤵
                        • Modifies boot configuration data using bcdedit
                        PID:1044
                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                      4⤵
                      • Executes dropped EXE
                      PID:272
                    • C:\Windows\system32\bcdedit.exe
                      C:\Windows\Sysnative\bcdedit.exe /v
                      4⤵
                      • Modifies boot configuration data using bcdedit
                      PID:1768
                    • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                      4⤵
                      • Executes dropped EXE
                      PID:1656
                    • C:\Windows\system32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      4⤵
                      • DcRat
                      • Creates scheduled task(s)
                      PID:1892
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:1580
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        5⤵
                          PID:1956
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            6⤵
                            • Launches sc.exe
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2196
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Modifies Installed Components in the registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:280
                • C:\Windows\system32\makecab.exe
                  "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240401045619.log C:\Windows\Logs\CBS\CbsPersist_20240401045619.cab
                  1⤵
                  • Drops file in Windows directory
                  PID:2116
                • C:\Windows\windefender.exe
                  C:\Windows\windefender.exe
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:2356

                Network

                MITRE ATT&CK Matrix ATT&CK v13

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                Scheduled Task/Job

                1
                T1053

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                2
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Defense Evasion

                Impair Defenses

                4
                T1562

                Disable or Modify Tools

                2
                T1562.001

                Disable or Modify System Firewall

                1
                T1562.004

                Modify Registry

                5
                T1112

                File and Directory Permissions Modification

                1
                T1222

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Credential Access

                Discovery

                Query Registry

                3
                T1012

                System Information Discovery

                3
                T1082

                Peripheral Device Discovery

                1
                T1120

                Lateral Movement

                Collection

                Exfiltration

                Command and Control

                Web Service

                1
                T1102

                Impact

                Resource Development

                Reconnaissance

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                  Filesize

                  1KB

                  MD5

                  f5d38a6b4d7dd26226946210bd98974e

                  SHA1

                  a76e96f9ed6df8e812d14b52ef4bbdb2a484964c

                  SHA256

                  131c777ed9d52e3945245f4c17159eb1b636542d04705284173e893b264de187

                  SHA512

                  47c8cb5ca742ff4dabaa44062c33c41fc5c549de8836f0b8e17f4bea4494c6ab0f93cfd361b68223fd2c75cd21b11526701c8c800ddc6ba7b389bf9ef3b96c41

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                  Filesize

                  68KB

                  MD5

                  29f65ba8e88c063813cc50a4ea544e93

                  SHA1

                  05a7040d5c127e68c25d81cc51271ffb8bef3568

                  SHA256

                  1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                  SHA512

                  e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                  Filesize

                  724B

                  MD5

                  8202a1cd02e7d69597995cabbe881a12

                  SHA1

                  8858d9d934b7aa9330ee73de6c476acf19929ff6

                  SHA256

                  58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

                  SHA512

                  97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                  Filesize

                  1KB

                  MD5

                  a266bb7dcc38a562631361bbf61dd11b

                  SHA1

                  3b1efd3a66ea28b16697394703a72ca340a05bd5

                  SHA256

                  df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

                  SHA512

                  0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                  Filesize

                  410B

                  MD5

                  3f8de571167e8a3f6585a52818c19959

                  SHA1

                  2527f59e9f1414906bdbb241aa4ee78c09152364

                  SHA256

                  f597e9f7dae42e2c1a793a3f4002a332aa0736bdd21f836b37603d8a36c3e97a

                  SHA512

                  a7b95f7ca79974ac296afab745f35326cc0148162425f601ce55ce85297e64074b59691c5bea9571f24413f760e4f273ab7cd78d37464709fcdab22df3fe68e1

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                  Filesize

                  304B

                  MD5

                  e6f130fd4b29d5cb48283bdd1cc0753e

                  SHA1

                  df509eee62f5f496521e1d7d82280a2c89bbc786

                  SHA256

                  f2ce2f793e577f9f9b06b0a7dd2172a1430c878477ded6b85dd216ed2704301b

                  SHA512

                  82fa531af203378103933ba8284993db1396c09db1b8aff58d4c8efe575425fe9e6a2412d3211332016bab862e1c1be283bbf93f25cb8ffcb9001178d2b2fca1

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                  Filesize

                  304B

                  MD5

                  ed8b53f54e69f35890793c6ae46346c7

                  SHA1

                  4afc704d2dd1ab3a1a0b794e824e0187bf1a2356

                  SHA256

                  658d8b54642bfc86012f1a177b2bd4dcd03a67fc595ffa94091bb57ca6cbcf38

                  SHA512

                  093a1027a8282b25899f45214fb306d7c84ef0c8f8e47821657e837802b592b2701589963bd85b5db3da9da3cebd721af680dab27e86523b59b01002a78273fc

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                  Filesize

                  304B

                  MD5

                  be3aa7103e01ac49ae77a90ae383eb7d

                  SHA1

                  8a74e4af7a15a78b58521ead6f4f42e8508913eb

                  SHA256

                  000d65d40a7329c5297c456750d4b59763ee092ff11e276109469e2658652fc6

                  SHA512

                  4198ce60ed681e30b887ab2c86ff67342a8f1955729eb609fe597a43288a32f704bf9ab494c30aec8ca46183dddcc212c51b61d80ab09a4da353e98dbc366281

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                  Filesize

                  304B

                  MD5

                  ecb79b0e3727bac56703ea919323285a

                  SHA1

                  c5ea9549b55024dfc2c0b92ff923a80419e54b6e

                  SHA256

                  dda2ae7c448d56fb05dc391472ce62eb81cc7724379f91e53fe99f5ae230f2f5

                  SHA512

                  e967e6c5630def8c8ce6d78b136d60a1e50e8dd33b3e99f21087008b662155b95dbfbdafa20073af47c5e06378b5c4e2917ff8fd4252f583b7a20e3a55e0416e

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                  Filesize

                  344B

                  MD5

                  c6e28134dc26d980e3537148392f821f

                  SHA1

                  394e3c27267cd1f24cb899feab7c29035516761d

                  SHA256

                  75414a38d3c41fb6793c9927b6ef4b0ccb2818f88db58e6b877c831f824a203d

                  SHA512

                  4a245ceb0dd491de0701e5cdf11d7df4a97b3eb209ebcb4115cd78190e9e22d22fe675b7bd4ac0401e836ae23a0e1fb338e6b73b68544ed8c8016dd484c404cc

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
                  Filesize

                  392B

                  MD5

                  8855ba16a4183b93cf918784bca880fc

                  SHA1

                  e7bc61e3dfceb5cd71795df243e12803643fa4b5

                  SHA256

                  6003b388b4655226ac82fb8dce37e22871028076e165e98d9204c63492dc9f6c

                  SHA512

                  762a921e1620b43192b985c8f72789d396fcb943942f2f3444b9a428e9a3aa299b3b447d57623a9756b99a61a6fcf88601b8fe47ca35420c8f9bb4e0326bccbc

                  Download Submit
                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                  Filesize

                  242B

                  MD5

                  852fdc37f6f7291af09eeb049d81f06f

                  SHA1

                  5843c45de60a774a121c92f1e753af9b7395c25f

                  SHA256

                  b554fe19e5cf580cd82a2128e891622da8127aa5412fb691110b7676c1446550

                  SHA512

                  cefaec17879facaef3caad6129928df6ad8b2b916f4f7f15abf40056bc48287d80800811858663717750a7e04268826d03c6e8f8479bcf6ad61e27a2de687869

                  Download Submit
                • C:\Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build2.exe
                  Filesize

                  265KB

                  MD5

                  97563a191c32200a6f0dff251bdd40f8

                  SHA1

                  1d8bd22c19d703349428d0c8c9c8c10a1d068f50

                  SHA256

                  2389dff2f3f5459ebb8110c01eeedee11ce0c75c3bb735f6f5f76f8a7bb6e9f6

                  SHA512

                  810ada6b966b6bc58dfc980a49ee6a5d4482af338a47a567ca659ccf65d1834506792f39a12b45cd5f6dd138ed4e943ee8d6ef1ac45ee59ab217696ad9ae5ed8

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\35F1.exe
                  Filesize

                  6.5MB

                  MD5

                  9e52aa572f0afc888c098db4c0f687ff

                  SHA1

                  ef7c2bb222e69ad0e10c8686eb03dcbee7933c2b

                  SHA256

                  4a40f9d491f09521f4b0c6076a0eb488f6d8e1cf4b67aa6569c2ccce13556443

                  SHA512

                  d0991e682ae8c954721e905753b56c01f91b85313beb9996331793c3efa8acc13d574ef5ba44853ecc3e05822931ed655bad1924fa11b774a43e015f42185f62

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\58BB.exe
                  Filesize

                  4.2MB

                  MD5

                  84b7cf2ab343a836f3c68cfe66125038

                  SHA1

                  242e6f0afc63727fe2e1f01b414d11375de2009e

                  SHA256

                  3681d2d5e8545a4b2048d012bd56686414fcd5f4a5112787026570ca57b9136c

                  SHA512

                  1afb24ad8ab896d1314f3e3e349b13f546b97c50c9e284a974f0122b02dfa998fc4be9e3b0a737bcb04a5e5c6cd823b43e0d7f0b09132cf3256cb85daf0e9183

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\98A7.bat
                  Filesize

                  77B

                  MD5

                  55cc761bf3429324e5a0095cab002113

                  SHA1

                  2cc1ef4542a4e92d4158ab3978425d517fafd16d

                  SHA256

                  d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                  SHA512

                  33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\A989.exe
                  Filesize

                  767KB

                  MD5

                  82262c6ac3f680888cf71474f1a5b879

                  SHA1

                  2a2133e3e8ab3fa899b403e2c86dc6ad245ed8ae

                  SHA256

                  49ce401fdaf7bf994254ec160dc5b114659795b2c45ad118cc8d884fe6612142

                  SHA512

                  d7ea630656c4767cba49de6ba638b9ee59b8a1e19ed41b05b20b70cbcd3ed3c5cba7e8a98e78eb3bd7bd9f7594c2e9908f0633f78d8742c36e6dd8ad02057349

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\CabB857.tmp
                  Filesize

                  65KB

                  MD5

                  ac05d27423a85adc1622c714f2cb6184

                  SHA1

                  b0fe2b1abddb97837ea0195be70ab2ff14d43198

                  SHA256

                  c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                  SHA512

                  6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                  Filesize

                  8.3MB

                  MD5

                  fd2727132edd0b59fa33733daa11d9ef

                  SHA1

                  63e36198d90c4c2b9b09dd6786b82aba5f03d29a

                  SHA256

                  3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

                  SHA512

                  3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                  Filesize

                  492KB

                  MD5

                  fafbf2197151d5ce947872a4b0bcbe16

                  SHA1

                  a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                  SHA256

                  feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                  SHA512

                  acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\TarD366.tmp
                  Filesize

                  171KB

                  MD5

                  9c0c641c06238516f27941aa1166d427

                  SHA1

                  64cd549fb8cf014fcd9312aa7a5b023847b6c977

                  SHA256

                  4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                  SHA512

                  936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\TarD485.tmp
                  Filesize

                  177KB

                  MD5

                  435a9ac180383f9fa094131b173a2f7b

                  SHA1

                  76944ea657a9db94f9a4bef38f88c46ed4166983

                  SHA256

                  67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                  SHA512

                  1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  Filesize

                  281KB

                  MD5

                  d98e33b66343e7c96158444127a117f6

                  SHA1

                  bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                  SHA256

                  5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                  SHA512

                  705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                  Filesize

                  1.7MB

                  MD5

                  13aaafe14eb60d6a718230e82c671d57

                  SHA1

                  e039dd924d12f264521b8e689426fb7ca95a0a7b

                  SHA256

                  f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                  SHA512

                  ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                  Filesize

                  591KB

                  MD5

                  e2f68dc7fbd6e0bf031ca3809a739346

                  SHA1

                  9c35494898e65c8a62887f28e04c0359ab6f63f5

                  SHA256

                  b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                  SHA512

                  26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                  Download Submit
                • \Users\Admin\AppData\Local\5ed98252-8d19-4c86-9b46-91276e777bd6\build3.exe
                  Filesize

                  299KB

                  MD5

                  41b883a061c95e9b9cb17d4ca50de770

                  SHA1

                  1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                  SHA256

                  fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                  SHA512

                  cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                  Download Submit
                • \Users\Admin\AppData\Local\Temp\dbghelp.dll
                  Filesize

                  1.5MB

                  MD5

                  f0616fa8bc54ece07e3107057f74e4db

                  SHA1

                  b33995c4f9a004b7d806c4bb36040ee844781fca

                  SHA256

                  6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

                  SHA512

                  15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

                  Download Submit
                • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                  Filesize

                  5.3MB

                  MD5

                  1afff8d5352aecef2ecd47ffa02d7f7d

                  SHA1

                  8b115b84efdb3a1b87f750d35822b2609e665bef

                  SHA256

                  c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                  SHA512

                  e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                  Download Submit
                • \Users\Admin\AppData\Local\Temp\symsrv.dll
                  Filesize

                  163KB

                  MD5

                  5c399d34d8dc01741269ff1f1aca7554

                  SHA1

                  e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                  SHA256

                  e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                  SHA512

                  8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                  Download Submit
                • memory/280-551-0x0000000004330000-0x0000000004331000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/280-434-0x0000000004330000-0x0000000004331000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/588-430-0x0000000004A50000-0x0000000004E48000-memory.dmp
                  Filesize

                  4.0MB

                  Download
                • memory/588-421-0x0000000000400000-0x0000000003125000-memory.dmp
                  Filesize

                  45.1MB

                  Download
                • memory/588-420-0x0000000004E50000-0x000000000573B000-memory.dmp
                  Filesize

                  8.9MB

                  Download
                • memory/588-416-0x0000000004A50000-0x0000000004E48000-memory.dmp
                  Filesize

                  4.0MB

                  Download
                • memory/588-431-0x0000000000400000-0x0000000003125000-memory.dmp
                  Filesize

                  45.1MB

                  Download
                • memory/1096-709-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/1096-708-0x0000000000250000-0x0000000000350000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/1188-4-0x0000000002130000-0x0000000002146000-memory.dmp
                  Filesize

                  88KB

                  Download
                • memory/1228-271-0x0000000000400000-0x0000000000648000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/1228-105-0x0000000000400000-0x0000000000648000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/1228-101-0x0000000000400000-0x0000000000648000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/1228-97-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/1228-104-0x0000000000400000-0x0000000000648000-memory.dmp
                  Filesize

                  2.3MB

                  Download
                • memory/1556-713-0x0000000000910000-0x0000000000A10000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/1580-642-0x0000000000400000-0x00000000008DF000-memory.dmp
                  Filesize

                  4.9MB

                  Download
                • memory/1580-645-0x0000000000400000-0x00000000008DF000-memory.dmp
                  Filesize

                  4.9MB

                  Download
                • memory/2020-261-0x0000000000220000-0x0000000000224000-memory.dmp
                  Filesize

                  16KB

                  Download
                • memory/2020-259-0x0000000000930000-0x0000000000A30000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/2096-469-0x0000000140000000-0x00000001405E8000-memory.dmp
                  Filesize

                  5.9MB

                  Download
                • memory/2096-453-0x0000000140000000-0x00000001405E8000-memory.dmp
                  Filesize

                  5.9MB

                  Download
                • memory/2356-643-0x0000000000400000-0x00000000008DF000-memory.dmp
                  Filesize

                  4.9MB

                  Download
                • memory/2356-658-0x0000000000400000-0x00000000008DF000-memory.dmp
                  Filesize

                  4.9MB

                  Download
                • memory/2412-267-0x0000000000400000-0x0000000000406000-memory.dmp
                  Filesize

                  24KB

                  Download
                • memory/2412-269-0x0000000000400000-0x0000000000406000-memory.dmp
                  Filesize

                  24KB

                  Download
                • memory/2412-264-0x0000000000400000-0x0000000000406000-memory.dmp
                  Filesize

                  24KB

                  Download
                • memory/2412-260-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2460-429-0x0000000000400000-0x0000000003125000-memory.dmp
                  Filesize

                  45.1MB

                  Download
                • memory/2460-428-0x0000000004E70000-0x000000000575B000-memory.dmp
                  Filesize

                  8.9MB

                  Download
                • memory/2460-427-0x0000000004A70000-0x0000000004E68000-memory.dmp
                  Filesize

                  4.0MB

                  Download
                • memory/2460-447-0x0000000000400000-0x0000000003125000-memory.dmp
                  Filesize

                  45.1MB

                  Download
                • memory/2564-600-0x00000000002F0000-0x00000000003F0000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/2568-26-0x0000000000300000-0x0000000000391000-memory.dmp
                  Filesize

                  580KB

                  Download
                • memory/2568-27-0x0000000000300000-0x0000000000391000-memory.dmp
                  Filesize

                  580KB

                  Download
                • memory/2568-31-0x00000000046B0000-0x00000000047CB000-memory.dmp
                  Filesize

                  1.1MB

                  Download
                • memory/2716-36-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2716-58-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2716-33-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2716-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2716-37-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2724-98-0x0000000000600000-0x0000000000700000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/2724-100-0x0000000000230000-0x0000000000265000-memory.dmp
                  Filesize

                  212KB

                  Download
                • memory/2736-62-0x00000000002A0000-0x0000000000331000-memory.dmp
                  Filesize

                  580KB

                  Download
                • memory/2736-60-0x00000000002A0000-0x0000000000331000-memory.dmp
                  Filesize

                  580KB

                  Download
                • memory/2764-281-0x00000000008C0000-0x00000000009C0000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/2768-311-0x0000000000140000-0x0000000000141000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2768-307-0x0000000000130000-0x0000000000131000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2768-316-0x0000000000150000-0x0000000000151000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2768-298-0x00000000009E0000-0x00000000016C5000-memory.dmp
                  Filesize

                  12.9MB

                  Download
                • memory/2768-313-0x0000000000140000-0x0000000000141000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2768-303-0x0000000000130000-0x0000000000131000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2768-432-0x00000000009E0000-0x00000000016C5000-memory.dmp
                  Filesize

                  12.9MB

                  Download
                • memory/2768-308-0x00000000009E0000-0x00000000016C5000-memory.dmp
                  Filesize

                  12.9MB

                  Download
                • memory/2768-305-0x0000000000130000-0x0000000000131000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2768-335-0x0000000000290000-0x0000000000291000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2768-309-0x0000000000140000-0x0000000000141000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/2784-448-0x0000000000400000-0x0000000003125000-memory.dmp
                  Filesize

                  45.1MB

                  Download
                • memory/2784-446-0x0000000004980000-0x0000000004D78000-memory.dmp
                  Filesize

                  4.0MB

                  Download
                • memory/2784-555-0x0000000000400000-0x0000000003125000-memory.dmp
                  Filesize

                  45.1MB

                  Download
                • memory/2824-255-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2824-83-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2824-68-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2824-191-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2824-190-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2824-188-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2824-116-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2824-69-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2824-82-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/2988-560-0x0000000000870000-0x0000000000970000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/3020-670-0x0000000000230000-0x0000000000330000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/3060-1-0x00000000005C0000-0x00000000006C0000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/3060-5-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/3060-3-0x0000000000400000-0x0000000000537000-memory.dmp
                  Filesize

                  1.2MB

                  Download
                • memory/3060-2-0x0000000000220000-0x000000000022B000-memory.dmp
                  Filesize

                  44KB

                  Download