Overview

overview

10

Static

static

1

15ce9e8856...21.exe

windows7-x64

1

15ce9e8856...21.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-04-2024 09:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    15ce9e885610d5b85500ea0d139f6d21.exe

  • Size

    404KB

  • MD5

    15ce9e885610d5b85500ea0d139f6d21

  • SHA1

    99f1392185a70453f33e15d6f5b75064217c2c18

  • SHA256

    95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e

  • SHA512

    9ee8e3fb682cf7abb5804106f841551f2f0fd8ace9842e67f3bda573772d39a6482d19e853de5a9a48d177350a3398cb814105ced01fdfb1be6db7e8bc9055b9

  • SSDEEP

    6144:/IJTLRoSz47P8DiLdwXQIPcnEPjj9tQPBBpRPZi9opzUeqcnoKPcmPuJkJ:wlRoSz4j8DM6gIxfUP+2Ye9oCcmf

Score
10/10
gluptebastealcdiscoverydropperevasionloaderpersistencerootkitspywarestealertrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 18 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\15ce9e885610d5b85500ea0d139f6d21.exe
    "C:\Users\Admin\AppData\Local\Temp\15ce9e885610d5b85500ea0d139f6d21.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Checks computer location settings
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\15ce9e885610d5b85500ea0d139f6d21.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\Pictures\lSS3BzDye3aTxNCsU2ewza0t.exe
        "C:\Users\Admin\Pictures\lSS3BzDye3aTxNCsU2ewza0t.exe"
        3⤵
        • Modifies firewall policy service
        • Windows security bypass
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Windows security modification
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:588
      • C:\Users\Admin\Pictures\W8hglg70dB3ovhQOWhV1JRi6.exe
        "C:\Users\Admin\Pictures\W8hglg70dB3ovhQOWhV1JRi6.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1060
        • C:\Users\Admin\Pictures\W8hglg70dB3ovhQOWhV1JRi6.exe
          "C:\Users\Admin\Pictures\W8hglg70dB3ovhQOWhV1JRi6.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:960
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2648
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2992
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              6⤵
              • Modifies Windows Firewall
              PID:2340
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1756
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2764
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Manipulates WinMonFS driver.
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4772
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              6⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1816
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              6⤵
              • Creates scheduled task(s)
              PID:5024
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /delete /tn ScheduledUpdate /f
              6⤵
                PID:2056
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                6⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4332
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                6⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:224
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:3604
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • Creates scheduled task(s)
                PID:2064
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  7⤵
                    PID:2648
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:228
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    7⤵
                      PID:3516
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        8⤵
                        • Launches sc.exe
                        • Suspicious use of AdjustPrivilegeToken
                        PID:944
            • C:\Users\Admin\Pictures\7ZPTgmi4rec2kZu3ZscElViI.exe
              "C:\Users\Admin\Pictures\7ZPTgmi4rec2kZu3ZscElViI.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1136
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1528
              • C:\Users\Admin\Pictures\7ZPTgmi4rec2kZu3ZscElViI.exe
                "C:\Users\Admin\Pictures\7ZPTgmi4rec2kZu3ZscElViI.exe"
                4⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:228
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2336
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:4004
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:2412
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1764
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3672
              • C:\Users\Admin\Pictures\KnCuzoHB6BpGE2sjuXnEMFco.exe
                "C:\Users\Admin\Pictures\KnCuzoHB6BpGE2sjuXnEMFco.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2344
                • C:\Users\Admin\AppData\Local\Temp\u1t4.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u1t4.0.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:4800
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 1016
                    5⤵
                    • Program crash
                    PID:3044
              • C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe
                "C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe" --silent --allusers=0
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Enumerates connected drives
                • Modifies system certificate store
                PID:4460
                • C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe
                  C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x6fc7e1d0,0x6fc7e1dc,0x6fc7e1e8
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4256
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\kbFYjI5MikGXBvlHDwGDXc0F.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\kbFYjI5MikGXBvlHDwGDXc0F.exe" --version
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2024
                • C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe
                  "C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4460 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240420095356" --session-guid=16c9430d-53f0-4646-9a68-4692fe288f10 --server-tracking-blob="YjE4YWFiMDJiZDY5MjFhODM0M2MxNzgyMjdlNmVhZTI2MTg0MTUzYTA3MmYwZDhjMTBiMTgzYTkwYzY1YWQyMTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEzNjA2NzkzLjc1NDIiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiYzdhYjEwMTAtODA2Mi00NzQzLTlhZmYtZjU1YTAzOGQ0YTQxIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=6805000000000000
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Enumerates connected drives
                  PID:3392
                  • C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe
                    C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x2a0,0x2a4,0x2b4,0x274,0x2b8,0x6ea4e1d0,0x6ea4e1dc,0x6ea4e1e8
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:4800
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:4896
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\assistant_installer.exe
                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\assistant_installer.exe" --version
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:3440
                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\assistant_installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x8c6038,0x8c6044,0x8c6050
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:1092
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
            1⤵
              PID:904
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
              1⤵
                PID:1568
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4800 -ip 4800
                1⤵
                  PID:4844
                • C:\Windows\windefender.exe
                  C:\Windows\windefender.exe
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:3992

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Privilege Escalation

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Defense Evasion

                Abuse Elevation Control Mechanism

                1
                T1548

                Bypass User Account Control

                1
                T1548.002

                Impair Defenses

                4
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Disable or Modify Tools

                3
                T1562.001

                Modify Registry

                7
                T1112

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Virtualization/Sandbox Evasion

                1
                T1497

                Credential Access

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                6
                T1012

                System Information Discovery

                6
                T1082

                Virtualization/Sandbox Evasion

                1
                T1497

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                  Filesize

                  2KB

                  MD5

                  1d7f3d1036cc09d2b9c5d8d5acfbb867

                  SHA1

                  5a76ade3e2ced7d72b6ce450b074d3c5aaa13b85

                  SHA256

                  0725190ee120338da973024f3d633bd17d0009af194000fa0a91dde961a8d76c

                  SHA512

                  dc993da2058b91cd4870b0e868963cadd68d0c03aee091691d7ed0a027215ef5114c9d56ec8d9e228cd7d022339d277903fc12481e2e00df758a3915a17d1fd8

                  Download Submit
                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  21KB

                  MD5

                  7e9b297cc4d2a7072ff17a33674e8f1b

                  SHA1

                  3a4e92843ac80174d9cbb4c9d8b288ec9aebddb0

                  SHA256

                  f0f918ab9c0380d1d255e579cf97e8c7b5b10a4880173b431f01fcd4e369b0c4

                  SHA512

                  a7bbdff5094777053fa6944391a2f20ab846277b716097d0df5de2a21ed650bc3b3468453a6bec973847fa26d0aa1bde6f2814145b60063a0eb714a643e8f300

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\additional_file0.tmp
                  Filesize

                  2.5MB

                  MD5

                  15d8c8f36cef095a67d156969ecdb896

                  SHA1

                  a1435deb5866cd341c09e56b65cdda33620fcc95

                  SHA256

                  1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

                  SHA512

                  d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\assistant_installer.exe
                  Filesize

                  1.9MB

                  MD5

                  976bc8e5fe65f9bb56831e20f1747150

                  SHA1

                  f9e7f5628aaaabed9939ef055540e24590a9ccfb

                  SHA256

                  f53c916ccf3d24d6793227283de2db0f6cc98a2275413851807cc080643d21a0

                  SHA512

                  2858e7e08418b170b21b599afb02236d0480d35a5605de142f10976489e01daf2ad80df0f09c2eb38bc5a971336d1f6aa9909c520bcdb18e9c9a8e903379dcd9

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\dbgcore.dll
                  Filesize

                  166KB

                  MD5

                  9ebb919b96f6f94e1be4cdc6913ef629

                  SHA1

                  31e99ac4fba516f82b36bd81784e8d518b32f9df

                  SHA256

                  fdae21127deb16eb8ba36f2493d2255f4cb8ab4c18e8bd8ba5e587f5a7ecd119

                  SHA512

                  a1b42f7d2896da270bb3c80cf9b88c4b4f1491084e7aa7760eeea5533b26f041dc79b21d5ffd2bba2221fe118e0a8d912e170f24fd895c9315b1ee9c7adfe700

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\assistant\dbghelp.dll
                  Filesize

                  1.7MB

                  MD5

                  544255258f9d45b4608ccfd27a4ed1dd

                  SHA1

                  571e30ceb9c977817b5bbac306366ae59f773497

                  SHA256

                  3b02fc85602e83059f611c658e3cad6bc59c3c51214d4fe7e31f3ac31388dd68

                  SHA512

                  2093da881fa90eec2b90d1ca6eaaff608fe16ac612571a7fd5ed94dd5f7ff7e5c1e8c862bab0a228850829527886473e3942abd23a81d10cab8f9baad2cc7664

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404200953561\opera_package
                  Filesize

                  103.8MB

                  MD5

                  5014156e9ffbb75d1a8d5fc09fabdc42

                  SHA1

                  6968d1b5cec3039e53bbbedeee22e2d43d94c771

                  SHA256

                  7a01e11e1830ba3c154e5a6c383da15938b1e48f89a2fe4045cdd260924b6802

                  SHA512

                  bfc5c44881d0fa7bcbccfd530d874fa624adec50e1a16063a72de12876d2db10ca5edd6fa841ea63e9deca3ff2adf54065f50719fe051d41de92bb68edba4016

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404200953551214460.dll
                  Filesize

                  4.6MB

                  MD5

                  0415cb7be0361a74a039d5f31e72fa65

                  SHA1

                  46ae154436c8c059ee75cbc6a18ccda96bb2021d

                  SHA256

                  bb38a8806705980ee3e9181c099e8d5c425e6c9505a88e5af538ca6a48951798

                  SHA512

                  f71c2b9e1559aa4eb2d72f852ef9807c781d4a7b96b8e0c2c53b895885319146bd43aa6e4223d43159f3d40bc60704206404dc034500e47fca0a94e53b60239e

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zvh31mt5.occ.ps1
                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  Filesize

                  281KB

                  MD5

                  d98e33b66343e7c96158444127a117f6

                  SHA1

                  bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                  SHA256

                  5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                  SHA512

                  705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                  Download Submit
                • C:\Users\Admin\AppData\Local\Temp\u1t4.0.exe
                  Filesize

                  353KB

                  MD5

                  31cb8ff276a0a394c3572a942fb623c3

                  SHA1

                  e64b3f111a0cd572b201ecac2b3cab849b854a06

                  SHA256

                  e80bfaa0b68c7040402915f2d057e7114f0a0b16ca3e36dcd937bf19341347e8

                  SHA512

                  cd864f77c63943836a34e6daa52c4cc65bbd6c8bf064c841598dd12f48b65a0182ce8147ebd38f5aaf25196889b1e8d23a3c73fb9d4493a95199940f9786f1be

                  Download Submit
                • C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat
                  Filesize

                  40B

                  MD5

                  bfa176fb1836a487b721d6ed57f390a1

                  SHA1

                  213fd87cc8ae88da4ec975fd3b3b067f403d1d45

                  SHA256

                  e7228d212f63452763c8735d27930aeafbda97e8f32561e23b685f0f719eeb1b

                  SHA512

                  a78c3379c02028b72f35346d38fdaccd2fc32a8e6b5395f2416ce5d1df4876e573747aceaf94e7166e61a2634126e315ac58b3c6edcef1834186f475751f2a2b

                  Download Submit
                • C:\Users\Admin\Pictures\KnCuzoHB6BpGE2sjuXnEMFco.exe
                  Filesize

                  497KB

                  MD5

                  dedd4ef7176809952c6b5b2492d4a972

                  SHA1

                  770537e96bfbe3e2dc352af8dfe6edb8a8c971bd

                  SHA256

                  53167ba94a450f8bcda36276b9d53687b52ec8852dff3397ba64f6efbfd4ec0e

                  SHA512

                  189ff05c388569af1ea5f871a16ef8fdb332a1c5f04c04b2e8079560ea195fa61ec25f85bb4f793c7d89f0acdee54f77531ff02acaf728b6677e00a0fcbfbd41

                  Download Submit
                • C:\Users\Admin\Pictures\W8hglg70dB3ovhQOWhV1JRi6.exe
                  Filesize

                  4.2MB

                  MD5

                  3b4f81a6c1cf0d18a0228d9b5797c1d1

                  SHA1

                  a1bbeccb2e61c5fbd1ce35898418a5f95fb1130c

                  SHA256

                  ef70e45cd7609f524ec2a8b4e03c846f637e6fbe04eaa46f6295609ee51f1302

                  SHA512

                  e7979818b4790f8089cd5c5c7d61664f08e99ea7d809e73bc31f963db2bc67fc24af486a44313b8bc878f7bb569d2b60c841e6e2548c5be98b63a11abf6c50c9

                  Download Submit
                • C:\Users\Admin\Pictures\cHDic2Hc3lDxpbMEpVWOx5wu.exe
                  Filesize

                  7KB

                  MD5

                  5b423612b36cde7f2745455c5dd82577

                  SHA1

                  0187c7c80743b44e9e0c193e993294e3b969cc3d

                  SHA256

                  e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                  SHA512

                  c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                  Download Submit
                • C:\Users\Admin\Pictures\kbFYjI5MikGXBvlHDwGDXc0F.exe
                  Filesize

                  5.1MB

                  MD5

                  e678bcaaaa82cbb60a4cfa108f6a2924

                  SHA1

                  15ebda85a3eb97e587b8d56df4b0b64cd20e0d19

                  SHA256

                  3ad68795686b9cb0ecb6d0f2f567596c71c0678882bfec72ae7df740d706bdb1

                  SHA512

                  37daa3c8312794b46378cb5dc980b9909ab1718eedf8901789cb0d816950047602854acf4f0804b69313f061ad0d84a9669a19657851ab24074c85a3df943aad

                  Download Submit
                • C:\Users\Admin\Pictures\lSS3BzDye3aTxNCsU2ewza0t.exe
                  Filesize

                  2.5MB

                  MD5

                  749cb9cb3ce89a03fdd97a9aaf96e895

                  SHA1

                  73ecd478ace66e1dfb7aeed8ed061af48214a46f

                  SHA256

                  85aeb0eca144912f0713ac4e8392e2645a91bb4ba8e2ffa55e5bf834665170af

                  SHA512

                  ac0afac898ab53a3277b4d1aef90af246ca8596872a6a61bbf47817c1ea038fc4394094a4d14d2cc0aa94aeaf1435f9ccc7cf7143010ff581fd4256dc653bd31

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                  Filesize

                  2KB

                  MD5

                  3d086a433708053f9bf9523e1d87a4e8

                  SHA1

                  b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                  SHA256

                  6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                  SHA512

                  931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  17KB

                  MD5

                  80db1f2252dd2cfa72911a05e3ed349d

                  SHA1

                  9a968a989c9572a21fdfd6521fa8ceefd45d72bb

                  SHA256

                  81fdd1fc842ca90e09fc054f3a7084970c7a0d412e2653727625e4551ddf8924

                  SHA512

                  53ea11670988f9315e0adf8cb41f2d480c52a06e0d8b678bbd34e153e368f404490c8e9edd1ea73ea7c2a50ddfcd1414fc5dc5d588c7633da05a253c37198cd5

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  19KB

                  MD5

                  a6ce4b0fd2f6b6cea988a1dcf2a117a6

                  SHA1

                  765506b551b90f5a96f2a28bf9aab31f9f0b4564

                  SHA256

                  b69bcecc88bb5803febe632261765d0141a947e95cda3ecea3cfaaef846beadf

                  SHA512

                  8a9e7253fcb3b18e4b5b713b063bb6cdc9f6258310e15f60f6b5a16bf69a0a5c45c82651daf1b651f1ee148a8ad9ad9c085bf3fb1c8ab50b3e7174ce6237bf0f

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  19KB

                  MD5

                  cbe1709df9026956d9dec2b0c215494f

                  SHA1

                  00e16bffdb1f795731b39b355779e680a7ceb291

                  SHA256

                  3ad03f4b1a8f0b30ae802676bc1e62e4126f7f3bd67e1b8b218fad0ca3b178a2

                  SHA512

                  210c80ee611c70fb11d4c4ab789188fd9d7e1ef680fc45410e80b947a730ea165406b82c803b6ae9019b0038713b8be279fc265d9e48dc58a14775e51adf2eb2

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  19KB

                  MD5

                  fff86db450abcea340ef76e896f44466

                  SHA1

                  211a6a7d09fd037518e50e0fec36c36e9774ab7b

                  SHA256

                  39a1ac24c969a4ab446590e7fafd4cd891e06396a5492d6894e7db1fb1f78c82

                  SHA512

                  0719518eb74628e7de6e87cc96bcf3c09d65259ae54581b677dfd91db6ec7044773b99ecae0f529c5de7a37e46bc643835c12df2e7388262981f8454418b0db0

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  19KB

                  MD5

                  5181a85a1c3f71dc116bbdded0d35a65

                  SHA1

                  d589d3a628a07a65f2ffd29124982fa9a1285b7f

                  SHA256

                  4622e2f65f48b0d408d5c7940caae9b537190ab36d5958d834b9501d9f9b0762

                  SHA512

                  7c888502142947995fba3035d36c52d98ecaef7c804eb146d918c50c66a43623370cd882fe77a6a749c75acb87478d32f36cf0eba026fdd6a9fbecec01db28e4

                  Download Submit
                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                  Filesize

                  19KB

                  MD5

                  4cab8fe01e8d569e8ec9be3c51252da4

                  SHA1

                  59e27e60aa350dd13dca7b5c6537c312afa9c097

                  SHA256

                  845bfa8c19a9489b6b355d71419c309cd7fc67cc23f9d85c51ffe1ac36dde4c6

                  SHA512

                  4f81c63c96b9945b496d734e42e6846584fd3d261560a8fed6c1d38c2ccb37112854c71dca1b78a7b8006b658fdfe33dfb351771deede475b00c9e2b59b6fb8d

                  Download Submit
                • C:\Windows\System32\GroupPolicy\gpt.ini
                  Filesize

                  127B

                  MD5

                  8ef9853d1881c5fe4d681bfb31282a01

                  SHA1

                  a05609065520e4b4e553784c566430ad9736f19f

                  SHA256

                  9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                  SHA512

                  5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                  Download Submit
                • C:\Windows\windefender.exe
                  Filesize

                  2.0MB

                  MD5

                  8e67f58837092385dcf01e8a2b4f5783

                  SHA1

                  012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                  SHA256

                  166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                  SHA512

                  40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                  Download Submit
                • memory/212-23-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/212-0-0x00000256FCDE0000-0x00000256FCDEE000-memory.dmp
                  Filesize

                  56KB

                  Download
                • memory/212-1-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/212-2-0x00000256FF3C0000-0x00000256FF3D0000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/212-3-0x00000256FD1E0000-0x00000256FD23E000-memory.dmp
                  Filesize

                  376KB

                  Download
                • memory/228-507-0x0000000000400000-0x00000000008DF000-memory.dmp
                  Filesize

                  4.9MB

                  Download
                • memory/228-418-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/588-46-0x0000000140000000-0x00000001408B7000-memory.dmp
                  Filesize

                  8.7MB

                  Download
                • memory/588-49-0x00007FFD00030000-0x00007FFD00031000-memory.dmp
                  Filesize

                  4KB

                  Download
                • memory/588-54-0x0000000140000000-0x00000001408B7000-memory.dmp
                  Filesize

                  8.7MB

                  Download
                • memory/588-51-0x0000000140000000-0x00000001408B7000-memory.dmp
                  Filesize

                  8.7MB

                  Download
                • memory/588-170-0x00007FFD00000000-0x00007FFD00002000-memory.dmp
                  Filesize

                  8KB

                  Download
                • memory/588-53-0x0000000140000000-0x00000001408B7000-memory.dmp
                  Filesize

                  8.7MB

                  Download
                • memory/588-55-0x0000000140000000-0x00000001408B7000-memory.dmp
                  Filesize

                  8.7MB

                  Download
                • memory/588-50-0x00007FFD16290000-0x00007FFD16485000-memory.dmp
                  Filesize

                  2.0MB

                  Download
                • memory/588-45-0x0000000140000000-0x00000001408B7000-memory.dmp
                  Filesize

                  8.7MB

                  Download
                • memory/588-117-0x0000000140000000-0x00000001408B7000-memory.dmp
                  Filesize

                  8.7MB

                  Download
                • memory/588-158-0x00007FFD15DC0000-0x00007FFD15E7E000-memory.dmp
                  Filesize

                  760KB

                  Download
                • memory/588-47-0x00007FFD15DC0000-0x00007FFD15E7E000-memory.dmp
                  Filesize

                  760KB

                  Download
                • memory/588-48-0x00007FFD00000000-0x00007FFD00002000-memory.dmp
                  Filesize

                  8KB

                  Download
                • memory/588-52-0x0000000140000000-0x00000001408B7000-memory.dmp
                  Filesize

                  8.7MB

                  Download
                • memory/960-399-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/1060-190-0x0000000007C00000-0x0000000007C0A000-memory.dmp
                  Filesize

                  40KB

                  Download
                • memory/1060-147-0x0000000006530000-0x000000000654E000-memory.dmp
                  Filesize

                  120KB

                  Download
                • memory/1060-136-0x0000000074E00000-0x00000000755B0000-memory.dmp
                  Filesize

                  7.7MB

                  Download
                • memory/1060-159-0x000000006FA80000-0x000000006FACC000-memory.dmp
                  Filesize

                  304KB

                  Download
                • memory/1060-149-0x0000000006A50000-0x0000000006A94000-memory.dmp
                  Filesize

                  272KB

                  Download
                • memory/1060-171-0x000000006FAD0000-0x000000006FE24000-memory.dmp
                  Filesize

                  3.3MB

                  Download
                • memory/1060-121-0x0000000002EF0000-0x0000000002F00000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1060-148-0x0000000006B50000-0x0000000006B9C000-memory.dmp
                  Filesize

                  304KB

                  Download
                • memory/1060-122-0x0000000002EF0000-0x0000000002F00000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1060-189-0x000000007F660000-0x000000007F670000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1060-151-0x0000000007F50000-0x00000000085CA000-memory.dmp
                  Filesize

                  6.5MB

                  Download
                • memory/1060-193-0x0000000002EF0000-0x0000000002F00000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1136-215-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/1136-111-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/1136-110-0x0000000003AC0000-0x0000000003EC5000-memory.dmp
                  Filesize

                  4.0MB

                  Download
                • memory/1136-94-0x0000000003ED0000-0x00000000047BB000-memory.dmp
                  Filesize

                  8.9MB

                  Download
                • memory/1528-169-0x00000000074A0000-0x00000000074BE000-memory.dmp
                  Filesize

                  120KB

                  Download
                • memory/1528-195-0x0000000007670000-0x0000000007706000-memory.dmp
                  Filesize

                  600KB

                  Download
                • memory/1528-157-0x000000006FAD0000-0x000000006FE24000-memory.dmp
                  Filesize

                  3.3MB

                  Download
                • memory/1528-156-0x000000007F8D0000-0x000000007F8E0000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1528-191-0x0000000004A10000-0x0000000004A20000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1528-154-0x0000000007460000-0x0000000007492000-memory.dmp
                  Filesize

                  200KB

                  Download
                • memory/1528-152-0x00000000072A0000-0x00000000072BA000-memory.dmp
                  Filesize

                  104KB

                  Download
                • memory/1528-150-0x00000000071F0000-0x0000000007266000-memory.dmp
                  Filesize

                  472KB

                  Download
                • memory/1528-172-0x00000000074C0000-0x0000000007563000-memory.dmp
                  Filesize

                  652KB

                  Download
                • memory/1528-137-0x0000000005A40000-0x0000000005D94000-memory.dmp
                  Filesize

                  3.3MB

                  Download
                • memory/1528-131-0x00000000058D0000-0x0000000005936000-memory.dmp
                  Filesize

                  408KB

                  Download
                • memory/1528-155-0x000000006FA80000-0x000000006FACC000-memory.dmp
                  Filesize

                  304KB

                  Download
                • memory/1528-130-0x00000000057F0000-0x0000000005856000-memory.dmp
                  Filesize

                  408KB

                  Download
                • memory/1528-124-0x0000000004F20000-0x0000000004F42000-memory.dmp
                  Filesize

                  136KB

                  Download
                • memory/1528-123-0x0000000004A10000-0x0000000004A20000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1528-116-0x00000000025B0000-0x00000000025E6000-memory.dmp
                  Filesize

                  216KB

                  Download
                • memory/1528-120-0x0000000004A10000-0x0000000004A20000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/1528-119-0x0000000074E00000-0x00000000755B0000-memory.dmp
                  Filesize

                  7.7MB

                  Download
                • memory/1528-118-0x0000000005050000-0x0000000005678000-memory.dmp
                  Filesize

                  6.2MB

                  Download
                • memory/2344-112-0x00000000036A0000-0x000000000370E000-memory.dmp
                  Filesize

                  440KB

                  Download
                • memory/2344-115-0x0000000001B30000-0x0000000001C30000-memory.dmp
                  Filesize

                  1024KB

                  Download
                • memory/2344-113-0x0000000000400000-0x0000000001A47000-memory.dmp
                  Filesize

                  22.3MB

                  Download
                • memory/2568-22-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/2568-15-0x00000114F0170000-0x00000114F0180000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/2568-16-0x00000114D7BC0000-0x00000114D7BE2000-memory.dmp
                  Filesize

                  136KB

                  Download
                • memory/2568-17-0x00000114F0170000-0x00000114F0180000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/2568-10-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp
                  Filesize

                  10.8MB

                  Download
                • memory/2936-91-0x0000000074E00000-0x00000000755B0000-memory.dmp
                  Filesize

                  7.7MB

                  Download
                • memory/2936-114-0x00000000050A0000-0x00000000050B0000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/2936-18-0x0000000074E00000-0x00000000755B0000-memory.dmp
                  Filesize

                  7.7MB

                  Download
                • memory/2936-19-0x00000000050A0000-0x00000000050B0000-memory.dmp
                  Filesize

                  64KB

                  Download
                • memory/2936-4-0x0000000000400000-0x0000000000408000-memory.dmp
                  Filesize

                  32KB

                  Download
                • memory/3992-553-0x0000000000400000-0x00000000008DF000-memory.dmp
                  Filesize

                  4.9MB

                  Download
                • memory/3992-576-0x0000000000400000-0x00000000008DF000-memory.dmp
                  Filesize

                  4.9MB

                  Download
                • memory/4468-109-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4468-92-0x0000000003B10000-0x0000000003F14000-memory.dmp
                  Filesize

                  4.0MB

                  Download
                • memory/4468-93-0x0000000003F20000-0x000000000480B000-memory.dmp
                  Filesize

                  8.9MB

                  Download
                • memory/4772-508-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-581-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-572-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-567-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-497-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-647-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-652-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-656-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-661-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4772-666-0x0000000000400000-0x0000000001E06000-memory.dmp
                  Filesize

                  26.0MB

                  Download
                • memory/4800-223-0x0000000000400000-0x0000000001A22000-memory.dmp
                  Filesize

                  22.1MB

                  Download