Overview

overview

10

Static

static

1

6b7baa1db0...4e.exe

windows7-x64

1

6b7baa1db0...4e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-04-2024 01:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6b7baa1db0d2ed5c12dfb8f289449384ff821110f9b490379c5fcd9190090f4e.exe

  • Size

    405KB

  • MD5

    dfe244414c8461175241ce54707eb6b6

  • SHA1

    1c94e583b7058d01dad42d56ef5ddf17b64b5778

  • SHA256

    6b7baa1db0d2ed5c12dfb8f289449384ff821110f9b490379c5fcd9190090f4e

  • SHA512

    a8b872308f2e4d51bf99617bad931117921a4332d2a4b2e84c6e45bf42829999a95883b146dca93894ffbd5bcd0f03cb682468457ac2ff1cefcb43155f4225c9

  • SSDEEP

    12288:eN6XS66ZeKgLaIGVkwpU0uNqFrNNkpICQzlG:26CNe0IGVl+qHul

Score
10/10
gluptebastealcdiscoverydropperevasionloaderpersistencerootkitstealerthemidatrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 16 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Detects Windows executables referencing non-Windows User-Agents 13 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 13 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 13 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 13 IoCs
  • Detects executables packed with Themida 7 IoCs
  • Detects executables packed with or use KoiVM 1 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 13 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • UPX dump on OEP (original entry point) 5 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 8 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b7baa1db0d2ed5c12dfb8f289449384ff821110f9b490379c5fcd9190090f4e.exe
    "C:\Users\Admin\AppData\Local\Temp\6b7baa1db0d2ed5c12dfb8f289449384ff821110f9b490379c5fcd9190090f4e.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Checks computer location settings
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3568
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6b7baa1db0d2ed5c12dfb8f289449384ff821110f9b490379c5fcd9190090f4e.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1004
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\Pictures\zN7M2OymWbBQ7XBDc2mMKxrA.exe
        "C:\Users\Admin\Pictures\zN7M2OymWbBQ7XBDc2mMKxrA.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4500
        • C:\Users\Admin\Pictures\zN7M2OymWbBQ7XBDc2mMKxrA.exe
          "C:\Users\Admin\Pictures\zN7M2OymWbBQ7XBDc2mMKxrA.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2144
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3136
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              6⤵
              • Modifies Windows Firewall
              PID:448
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4048
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:540
      • C:\Users\Admin\Pictures\rGsLbaDG7rFYUdkhIeeCmjMI.exe
        "C:\Users\Admin\Pictures\rGsLbaDG7rFYUdkhIeeCmjMI.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3132
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2004
        • C:\Users\Admin\Pictures\rGsLbaDG7rFYUdkhIeeCmjMI.exe
          "C:\Users\Admin\Pictures\rGsLbaDG7rFYUdkhIeeCmjMI.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4112
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4272
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1072
            • C:\Windows\System32\Conhost.exe
              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              6⤵
                PID:4500
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:3524
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2140
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1020
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Manipulates WinMonFS driver.
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4396
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                6⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1908
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • Creates scheduled task(s)
                PID:4796
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                6⤵
                  PID:5116
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2108
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3224
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1452
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:1072
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:2724
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    7⤵
                      PID:5064
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        8⤵
                        • Launches sc.exe
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3276
            • C:\Users\Admin\Pictures\4YJl5j2ei9LtwB2OKQuDobEH.exe
              "C:\Users\Admin\Pictures\4YJl5j2ei9LtwB2OKQuDobEH.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3460
              • C:\Users\Admin\AppData\Local\Temp\u2o4.0.exe
                "C:\Users\Admin\AppData\Local\Temp\u2o4.0.exe"
                4⤵
                • Executes dropped EXE
                PID:3584
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 1296
                  5⤵
                  • Program crash
                  PID:3304
              • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
                "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4168
                • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\UniversalInstaller.exe
                  C:\Users\Admin\AppData\Local\Temp\ZXB_tls\UniversalInstaller.exe
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:2348
                  • C:\Users\Admin\AppData\Roaming\ZXB_tls\UniversalInstaller.exe
                    C:\Users\Admin\AppData\Roaming\ZXB_tls\UniversalInstaller.exe
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetWindowsHookEx
                    PID:2536
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\SysWOW64\cmd.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      PID:220
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                        8⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2696
            • C:\Users\Admin\Pictures\DZWA0CgrbBsdwh7Go7vzXbEX.exe
              "C:\Users\Admin\Pictures\DZWA0CgrbBsdwh7Go7vzXbEX.exe"
              3⤵
              • Modifies firewall policy service
              • Windows security bypass
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Drops file in System32 directory
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:3884
            • C:\Users\Admin\Pictures\UdT7Hzv5kQdTdEBB5HZfOdnh.exe
              "C:\Users\Admin\Pictures\UdT7Hzv5kQdTdEBB5HZfOdnh.exe"
              3⤵
              • Executes dropped EXE
              PID:3440
              • C:\Users\Admin\AppData\Local\Temp\7zS5BE2.tmp\Install.exe
                .\Install.exe /nxdidQZJ "385118" /S
                4⤵
                • Checks BIOS information in registry
                • Checks computer location settings
                • Executes dropped EXE
                • Enumerates system info in registry
                PID:2552
                • C:\Windows\SysWOW64\forfiles.exe
                  "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                  5⤵
                    PID:3220
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      6⤵
                        PID:3976
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2600
                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                            "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3520
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 01:14:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\egOgHBb.exe\" em /iSsite_idann 385118 /S" /V1 /F
                      5⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:2616
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
                2⤵
                  PID:684
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3584 -ip 3584
                1⤵
                  PID:2600
                • C:\Windows\windefender.exe
                  C:\Windows\windefender.exe
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  PID:2144
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:4788
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:2956

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Scheduled Task/Job

                    1
                    T1053

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    2
                    T1543

                    Windows Service

                    2
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Privilege Escalation

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    2
                    T1543

                    Windows Service

                    2
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Defense Evasion

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Impair Defenses

                    4
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Disable or Modify Tools

                    3
                    T1562.001

                    Modify Registry

                    6
                    T1112

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    Credential Access

                    Discovery

                    Query Registry

                    6
                    T1012

                    System Information Discovery

                    6
                    T1082

                    Virtualization/Sandbox Evasion

                    1
                    T1497

                    Lateral Movement

                    Collection

                    Command and Control

                    Web Service

                    1
                    T1102

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\Canon_Inc_IC\UniversalInstaller\ServiceLog\CANON_UIX_SERVICELOG_20240421011221.TXT
                      Filesize

                      451B

                      MD5

                      e13beffa938cfc289cbbc41dd508a577

                      SHA1

                      1ce7ae0972c98fbd0ac8f133fe6f2c11e696c6d1

                      SHA256

                      f5233770a9b10c7f389e52db40da01c19cfb97fe21a17d73ada53726da0625a9

                      SHA512

                      dc55e1a75c262f16ba1721922c1a9cac9e081e994b4085840eeee0cbbc011ec9d7bf52d398f376a0ae05bb1a83d5c222b5370bb3ec44250deb79d6ef30e815ec

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      a6ea7bfcd3aac150c0caef765cb52281

                      SHA1

                      037dc22c46a0eb0b9ad4c74088129e387cffe96b

                      SHA256

                      f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9

                      SHA512

                      c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      21KB

                      MD5

                      5cf0ea1688b259998d3f79cc0878d661

                      SHA1

                      10dbab4ffcaaa05b8caae47328b0bd22733c0a08

                      SHA256

                      2c088c5b2ef239538357ae7b39561e26f811602f326c483fb8f67d167f8cff87

                      SHA512

                      7ae294eb475814e681715fcebf5047c227802bc6eddb801a861823ebd6bcc30b94e0e050447e1394a6e4cff23c19497eaaa118172c8741ef85c3377fb91f0dce

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      bd5940f08d0be56e65e5f2aaf47c538e

                      SHA1

                      d7e31b87866e5e383ab5499da64aba50f03e8443

                      SHA256

                      2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6

                      SHA512

                      c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\7zS5BE2.tmp\Install.exe
                      Filesize

                      6.8MB

                      MD5

                      e77964e011d8880eae95422769249ca4

                      SHA1

                      8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                      SHA256

                      f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                      SHA512

                      8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
                      Filesize

                      14.6MB

                      MD5

                      9eba9ca5f06b484cbbe41ed6fb4a8768

                      SHA1

                      b52ea3b800254b0b1ae2f19e442fe98cc575eb18

                      SHA256

                      5836b09135b1b8060226a6dd32b23a3985cbef5ca17b97102a851d8b8aa2c689

                      SHA512

                      827f380f0d552b75be688c0de1bb6051c8d4cecf3784c6b396ce710b4c20b1b57c7eb16335cab93f451d7f69110df83f580dd562d1f26bbd2d7ca902e5c6ea74

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\UIxMarketPlugin.dll
                      Filesize

                      1.6MB

                      MD5

                      8f75e17a8bf3de6e22e77b5586f8a869

                      SHA1

                      e0bf196cfc19a8772e003b9058bdc211b419b261

                      SHA256

                      5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

                      SHA512

                      5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\UniversalInstaller.exe
                      Filesize

                      2.4MB

                      MD5

                      9fb4770ced09aae3b437c1c6eb6d7334

                      SHA1

                      fe54b31b0db8665aa5b22bed147e8295afc88a03

                      SHA256

                      a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                      SHA512

                      140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\relay.dll
                      Filesize

                      1.5MB

                      MD5

                      7d2f87123e63950159fb2c724e55bdab

                      SHA1

                      360f304a6311080e1fead8591cb4659a8d135f2d

                      SHA256

                      b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

                      SHA512

                      6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\somebody.rtf
                      Filesize

                      24KB

                      MD5

                      ff36ebcf134c8846aea77446867e5bc6

                      SHA1

                      53fdf2c0bec711e377edb4f97cd147728fb568f6

                      SHA256

                      e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

                      SHA512

                      b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\spawn.xml
                      Filesize

                      1.2MB

                      MD5

                      0d4b3bef832fe7d161ec85f9a3ae2033

                      SHA1

                      98af2a1125bf6e1890ce6dab84834eecdef30d95

                      SHA256

                      422c6e1fec6485e29bbc20e3f74db6bc1d01be6acfbcaa10b7d9041e5fee8670

                      SHA512

                      730d1a012eaa109a87705c2b6a53280f99ca8361ad6186df7cd7bf452cbf748bc94e894c35e6cf0590014baf025a3061bce1107fb724922061afdcedf6e7b971

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gypv1ggw.zrz.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ba9bfc8
                      Filesize

                      1.4MB

                      MD5

                      92d165b45cda1efe110dd07fc3917dcb

                      SHA1

                      851493e30117754e9a4917b116eeb0bd007849ff

                      SHA256

                      ebe6adb35e14c1d9fb6cc42eaa0ca9f9ced7abf5c587861c26f4f505623fb0cc

                      SHA512

                      fa7f953c62023ce2acf844325d9290148152101ef80f3e15b439148feda838b196be6591d8efa4abcac89e194b9c30f4031f64ce1711a674d01af94b1f344716

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      Filesize

                      281KB

                      MD5

                      d98e33b66343e7c96158444127a117f6

                      SHA1

                      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                      SHA256

                      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                      SHA512

                      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ffc9bb97
                      Filesize

                      5.8MB

                      MD5

                      b96e10e36a9ef9a31b805f9749e57ae3

                      SHA1

                      bc39aa27931f264be23c4d603d5dbaf09ca8f37e

                      SHA256

                      ba11437b4ceb6ce1493ec4428eac92404425a4da52cfbe1292e4b2b325c90d02

                      SHA512

                      cb1c82e0ab8d89a0fe05ec5953fc0dbe16f38439155b6a585fdb2577c86dcfa55bfea0c88145123d9d3ab70ac7af09f6a5ee428e8aab0c1d184bbfdd836afda5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\u2o4.0.exe
                      Filesize

                      301KB

                      MD5

                      5d835a5d56e1b106a3928a3f96f28c0a

                      SHA1

                      76637a8a47e97b2eca53f849e0e95fc1a5683fa5

                      SHA256

                      a676e2601f65bd27a7d0c7cc2cf9452ef9880a544c01d75692c2c211699b58fd

                      SHA512

                      c5b2a3ce8afd27f6a95b29874643eb4dfd7da56550b2451fe16705865c10af6ddc3bb7c94aec5840ed4b1a5d8df630719128dbf1169b2e5c7e0e2e7998a9c6d5

                      Download Submit

                    • C:\Users\Admin\Pictures\4YJl5j2ei9LtwB2OKQuDobEH.exe
                      Filesize

                      444KB

                      MD5

                      a977f50dd4332125e5549da181e1b6c4

                      SHA1

                      f08301780e4a044345cf9d513adacef57058ef7b

                      SHA256

                      5d4cd79354570270f52c6647993ab42b00ab3f388d9503b4104286d1497caba1

                      SHA512

                      049c66eabad487eb262a27de3d7efd3e77c35ed7196e34d58b79472c0c4b153cc104ae85adfce2a45bf58bbd42bc7fd9d01a75ecdd1acbe63b654cff8c9b9dba

                      Download Submit

                    • C:\Users\Admin\Pictures\DZWA0CgrbBsdwh7Go7vzXbEX.exe
                      Filesize

                      3.9MB

                      MD5

                      ffee05ea98b1d51026a44fad0841a8a9

                      SHA1

                      50a703329c7b9812c17a02b554cf406040079fec

                      SHA256

                      4cb040696b9ffb14794955b0e56eed04fde0cae3a5ee748dd513ad42c411c823

                      SHA512

                      626ddc18a906b74a231daa5bcc092a90708e0e3d42e4db645d59d19de7ef38a2d91a843f11dbc7873d379bfa14e87c5fc6d09a657e0b44abd24b9991cb971f86

                      Download Submit

                    • C:\Users\Admin\Pictures\UdT7Hzv5kQdTdEBB5HZfOdnh.exe
                      Filesize

                      6.4MB

                      MD5

                      aaa56797070369ad346fbd9bb6cc5e8b

                      SHA1

                      a1d01943f0a354d3a000628262671254ca6a91b8

                      SHA256

                      9d7d08ac35f0113f7c814d257bf88b8222975aaa0a3fdeda88ac7185dbc50905

                      SHA512

                      e69d25a158567c6bce6e9450de17d0814b9b9c11f4bb31e5dcc3e8b4378062cc7e31da625f6ba4a2280b393034a6c832a0fc0a1e16364dc7e8c8146de245b5be

                      Download Submit

                    • C:\Users\Admin\Pictures\cg8Qyst7dToX04vE4Vn6eYvp.exe
                      Filesize

                      7KB

                      MD5

                      5b423612b36cde7f2745455c5dd82577

                      SHA1

                      0187c7c80743b44e9e0c193e993294e3b969cc3d

                      SHA256

                      e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                      SHA512

                      c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                      Download Submit

                    • C:\Users\Admin\Pictures\zN7M2OymWbBQ7XBDc2mMKxrA.exe
                      Filesize

                      4.2MB

                      MD5

                      12c1251ddacc8c6651573aaae2a36711

                      SHA1

                      aa4a4fc95f24a847f33a0fcc22d318fe947929d0

                      SHA256

                      a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22

                      SHA512

                      e8e9723b210254504ae06f77ed86ff5c7da0ac1ba5134cb2ab99cd42b06744cdf2379835d5e8cbd413da69b1184a0d6297d29dc8393794d8959c5a2dc94f0a69

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      3d086a433708053f9bf9523e1d87a4e8

                      SHA1

                      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                      SHA256

                      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                      SHA512

                      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      5a66b2c102c8dbde2cd563c49f1c82c2

                      SHA1

                      6087537700250d66bbdeeda1d692f5d8668e197d

                      SHA256

                      9a839e5f79d817c8ff96630013d329ff9f8202cb03bbc50969bc51627e24233d

                      SHA512

                      5a2d7b4e9fdc1a8a880f6fc81842be7d612cba3d9ac1c92cb1999c75775ff96db07129ef61e107061bda402194e72767970d4f660efb8068b193f1420ab68307

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      efc5c93084a86f4ae7528111b37e35bc

                      SHA1

                      74726a1e1fe009d9918d406b171a39900adc8412

                      SHA256

                      c977dacbd2149f73c402796bcb6336f462b32a5a44291ed103f22a4885016d02

                      SHA512

                      34c6185280fae126646c9515cf507b5815d89ef31886fd32443be31075a7cee6eaa9671f068e6a097c7cb6d123a6c2b969950defef87ddbb1d5a19391158dbfc

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      ca2b7234c1612567f9eaebc45b1386a8

                      SHA1

                      d705cfad8ba7f4f561db6a5a954d44390c49ea55

                      SHA256

                      8f987a6f9f170c03d82061fb27563dc66da4daa69dcbd82c9bd5df3fa6f54d0e

                      SHA512

                      427362867f5f74adc6cb97bec41307a813db03e6590a1a2f83bcf853a28c44b97d73822323f35e35f7a7e602667ab24cb6171b33b06a09f59731d799d5434ec3

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      ea9bd83a4581f8d791c29a1a7f2d00dc

                      SHA1

                      23468f157f7f2d62bfc738f44f2ff7f1142d77a9

                      SHA256

                      0db77455c3daf9935d461ece10a68c05a3648c959529857184f632222952e099

                      SHA512

                      01bc6e2a80b8f6acd5b197715a7f1857b406579c240c2d4ffac452dcf8dd7e51693adac93f80e4d7ac854cc93e785eb428ae9c58fcc3d3de955b46cdab369bc7

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      e0d9afc51e25bd75a6e68e2ef6e89673

                      SHA1

                      cdc4e19cdd268d30e37ad8c47e057ba88553072c

                      SHA256

                      7354146d24593fa931920465f5561df691fc1d8b655fbf6bd1625163fc12e982

                      SHA512

                      cfd87c3dbd8a678d4414ff7e18943d6ed19a602faa1fc962f3598dfa143cb708c94ef02008f86b0395cf746588fa8adf70d38c28200c1a6d0a2f39c470fe4b3b

                      Download Submit

                    • C:\Windows\windefender.exe
                      Filesize

                      2.0MB

                      MD5

                      8e67f58837092385dcf01e8a2b4f5783

                      SHA1

                      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                      SHA256

                      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                      SHA512

                      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                      Download Submit

                    • memory/1004-16-0x000001CB70380000-0x000001CB70390000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1004-21-0x00007FF886400000-0x00007FF886EC1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/1004-17-0x000001CB70380000-0x000001CB70390000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1004-15-0x00007FF886400000-0x00007FF886EC1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/1004-12-0x000001CB72470000-0x000001CB72492000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/1952-407-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/1952-173-0x0000000003A40000-0x0000000003E3B000-memory.dmp

                      Filesize

                      4.0MB

                      Download

                    • memory/2004-106-0x0000000007900000-0x0000000007932000-memory.dmp

                      Filesize

                      200KB

                      Download

                    • memory/2004-162-0x0000000074EA0000-0x0000000075650000-memory.dmp

                      Filesize

                      7.7MB

                      Download

                    • memory/2004-89-0x0000000005DC0000-0x0000000006114000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/2004-103-0x0000000007560000-0x00000000075D6000-memory.dmp

                      Filesize

                      472KB

                      Download

                    • memory/2004-104-0x0000000007E60000-0x00000000084DA000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/2004-105-0x00000000074E0000-0x00000000074FA000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/2004-100-0x0000000006390000-0x00000000063AE000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/2004-75-0x0000000002C60000-0x0000000002C70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2004-132-0x0000000007960000-0x0000000007A03000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/2004-76-0x0000000005360000-0x00000000053C6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/2004-78-0x0000000074EA0000-0x0000000075650000-memory.dmp

                      Filesize

                      7.7MB

                      Download

                    • memory/2004-135-0x0000000007A50000-0x0000000007A5A000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/2004-134-0x0000000002C60000-0x0000000002C70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2004-111-0x000000006FD20000-0x0000000070074000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/2004-122-0x0000000007940000-0x000000000795E000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/2004-136-0x0000000007B20000-0x0000000007BB6000-memory.dmp

                      Filesize

                      600KB

                      Download

                    • memory/2004-137-0x0000000007A80000-0x0000000007A91000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/2004-109-0x0000000070100000-0x000000007014C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2004-107-0x000000007F260000-0x000000007F270000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2004-79-0x0000000002C60000-0x0000000002C70000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2004-138-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/2084-64-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/2084-48-0x0000000003A70000-0x0000000003E77000-memory.dmp

                      Filesize

                      4.0MB

                      Download

                    • memory/2084-156-0x0000000003E80000-0x000000000476B000-memory.dmp

                      Filesize

                      8.9MB

                      Download

                    • memory/2084-49-0x0000000003E80000-0x000000000476B000-memory.dmp

                      Filesize

                      8.9MB

                      Download

                    • memory/2084-133-0x0000000003A70000-0x0000000003E77000-memory.dmp

                      Filesize

                      4.0MB

                      Download

                    • memory/2084-285-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/2084-167-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/2144-522-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2144-510-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2144-528-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2724-504-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/2936-69-0x0000000005290000-0x00000000052A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2936-67-0x0000000074EA0000-0x0000000075650000-memory.dmp

                      Filesize

                      7.7MB

                      Download

                    • memory/2936-18-0x0000000074EA0000-0x0000000075650000-memory.dmp

                      Filesize

                      7.7MB

                      Download

                    • memory/2936-4-0x0000000000400000-0x0000000000408000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/3132-65-0x00000000039F0000-0x0000000003DF5000-memory.dmp

                      Filesize

                      4.0MB

                      Download

                    • memory/3132-172-0x00000000039F0000-0x0000000003DF5000-memory.dmp

                      Filesize

                      4.0MB

                      Download

                    • memory/3132-68-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/3132-66-0x0000000003F00000-0x00000000047EB000-memory.dmp

                      Filesize

                      8.9MB

                      Download

                    • memory/3460-157-0x0000000001C40000-0x0000000001D40000-memory.dmp

                      Filesize

                      1024KB

                      Download

                    • memory/3460-404-0x0000000000400000-0x0000000001A3A000-memory.dmp

                      Filesize

                      22.2MB

                      Download

                    • memory/3460-161-0x0000000000400000-0x0000000001A3A000-memory.dmp

                      Filesize

                      22.2MB

                      Download

                    • memory/3460-158-0x00000000036E0000-0x000000000374E000-memory.dmp

                      Filesize

                      440KB

                      Download

                    • memory/3568-3-0x000001C91A030000-0x000001C91A08E000-memory.dmp

                      Filesize

                      376KB

                      Download

                    • memory/3568-1-0x00007FF886400000-0x00007FF886EC1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/3568-2-0x000001C901830000-0x000001C901840000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3568-0-0x000001C97F710000-0x000001C97F71E000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/3568-22-0x00007FF886400000-0x00007FF886EC1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/3584-298-0x0000000000400000-0x0000000001A16000-memory.dmp

                      Filesize

                      22.1MB

                      Download

                    • memory/3884-545-0x00007FF648550000-0x00007FF649059000-memory.dmp

                      Filesize

                      11.0MB

                      Download

                    • memory/3884-573-0x00007FF648550000-0x00007FF649059000-memory.dmp

                      Filesize

                      11.0MB

                      Download

                    • memory/3884-558-0x00007FF648550000-0x00007FF649059000-memory.dmp

                      Filesize

                      11.0MB

                      Download

                    • memory/3884-556-0x00007FF648550000-0x00007FF649059000-memory.dmp

                      Filesize

                      11.0MB

                      Download

                    • memory/3884-553-0x00007FF648550000-0x00007FF649059000-memory.dmp

                      Filesize

                      11.0MB

                      Download

                    • memory/3884-551-0x00007FF648550000-0x00007FF649059000-memory.dmp

                      Filesize

                      11.0MB

                      Download

                    • memory/4112-388-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/4168-595-0x00007FF886D50000-0x00007FF886EC2000-memory.dmp

                      Filesize

                      1.4MB

                      Download

                    • memory/4168-597-0x00007FF886D50000-0x00007FF886EC2000-memory.dmp

                      Filesize

                      1.4MB

                      Download

                    • memory/4168-589-0x00000000008A0000-0x0000000001766000-memory.dmp

                      Filesize

                      14.8MB

                      Download

                    • memory/4396-507-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/4396-492-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/4396-543-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/4396-525-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/4396-519-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/4396-513-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/4396-572-0x0000000000400000-0x0000000001DF9000-memory.dmp

                      Filesize

                      26.0MB

                      Download

                    • memory/4500-85-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4500-77-0x0000000005BE0000-0x0000000005C46000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/4500-112-0x000000006FD20000-0x0000000070074000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/4500-108-0x0000000070100000-0x000000007014C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4500-140-0x0000000007A50000-0x0000000007A6A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/4500-110-0x000000007FB20000-0x000000007FB30000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4500-71-0x00000000053D0000-0x00000000059F8000-memory.dmp

                      Filesize

                      6.2MB

                      Download

                    • memory/4500-101-0x00000000067B0000-0x00000000067FC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4500-74-0x0000000005240000-0x0000000005262000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/4500-73-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4500-72-0x0000000074EA0000-0x0000000075650000-memory.dmp

                      Filesize

                      7.7MB

                      Download

                    • memory/4500-70-0x0000000002C40000-0x0000000002C76000-memory.dmp

                      Filesize

                      216KB

                      Download

                    • memory/4500-139-0x0000000007960000-0x0000000007974000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/4500-102-0x0000000006720000-0x0000000006764000-memory.dmp

                      Filesize

                      272KB

                      Download

                    • memory/4500-146-0x0000000007990000-0x0000000007998000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/4500-166-0x0000000074EA0000-0x0000000075650000-memory.dmp

                      Filesize

                      7.7MB

                      Download