Overview

overview

10

Static

static

1

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-04-2024 05:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b79b3ab665881eadd15b67b9b105db7d99eb091905350a53c6bbc7b91a42cd48.exe

  • Size

    3.3MB

  • MD5

    09bd16d82a747ef0621aa367c0e14a9c

  • SHA1

    da57e4b192b7cb50b6e71b48d5f233d2a6b5a4f1

  • SHA256

    b79b3ab665881eadd15b67b9b105db7d99eb091905350a53c6bbc7b91a42cd48

  • SHA512

    7365b17d9ec7264941b88d61e69ea1214ef44b9b8bff9ebc8227794b696142050f267635cdb4e588ba121259b2f2a07519df8053f143db58ebc1a048d08b49a1

  • SSDEEP

    49152:9UIbNigeVE2MD7ZDAgUftcgFEptOkf8Ug:jI3bg5W

Score
10/10
gluptebastealcdiscoverydropperevasionloaderpersistencerootkitstealerthemidatrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.209

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 17 IoCs
  • Modifies firewall policy service 2 TTPs 1 IoCs
    evasion
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 4 IoCs
  • Themida packer 7 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 14 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\b79b3ab665881eadd15b67b9b105db7d99eb091905350a53c6bbc7b91a42cd48.exe
    "C:\Users\Admin\AppData\Local\Temp\b79b3ab665881eadd15b67b9b105db7d99eb091905350a53c6bbc7b91a42cd48.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2992
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
      2⤵
        PID:2020
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        2⤵
        • Drops startup file
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\Users\Admin\Pictures\6I64hwjvO3cAghk7nmA7AYb8.exe
          "C:\Users\Admin\Pictures\6I64hwjvO3cAghk7nmA7AYb8.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3204
          • C:\Users\Admin\AppData\Local\Temp\u2h0.0.exe
            "C:\Users\Admin\AppData\Local\Temp\u2h0.0.exe"
            4⤵
            • Executes dropped EXE
            PID:3232
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 1340
              5⤵
              • Program crash
              PID:1068
          • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
            "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2416
            • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\UniversalInstaller.exe
              C:\Users\Admin\AppData\Local\Temp\ZXB_tls\UniversalInstaller.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:3648
              • C:\Users\Admin\AppData\Roaming\ZXB_tls\UniversalInstaller.exe
                C:\Users\Admin\AppData\Roaming\ZXB_tls\UniversalInstaller.exe
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetWindowsHookEx
                PID:3988
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\SysWOW64\cmd.exe
                  7⤵
                    PID:4548
          • C:\Users\Admin\Pictures\HZ6p8GlFhdUDKSUiYOEyZl6j.exe
            "C:\Users\Admin\Pictures\HZ6p8GlFhdUDKSUiYOEyZl6j.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3392
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2404
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 2548
                5⤵
                • Program crash
                PID:3220
            • C:\Users\Admin\Pictures\HZ6p8GlFhdUDKSUiYOEyZl6j.exe
              "C:\Users\Admin\Pictures\HZ6p8GlFhdUDKSUiYOEyZl6j.exe"
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4964
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4428
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2900
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  PID:4076
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4008
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3580
              • C:\Windows\rss\csrss.exe
                C:\Windows\rss\csrss.exe
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Manipulates WinMonFS driver.
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1028
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  6⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1308
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:2400
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  6⤵
                    PID:2336
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1812
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3052
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    6⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2404
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:3756
                  • C:\Windows\windefender.exe
                    "C:\Windows\windefender.exe"
                    6⤵
                    • Executes dropped EXE
                    PID:1932
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      7⤵
                        PID:5004
                        • C:\Windows\SysWOW64\sc.exe
                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          8⤵
                          • Launches sc.exe
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3528
              • C:\Users\Admin\Pictures\xB1b1HYzvYnKePltQbtD12eL.exe
                "C:\Users\Admin\Pictures\xB1b1HYzvYnKePltQbtD12eL.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4992
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4976
                • C:\Users\Admin\Pictures\xB1b1HYzvYnKePltQbtD12eL.exe
                  "C:\Users\Admin\Pictures\xB1b1HYzvYnKePltQbtD12eL.exe"
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:1764
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:632
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4308
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      PID:2420
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1188
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4836
              • C:\Users\Admin\Pictures\3TjNPrHEYJsK2j9r745JhVKu.exe
                "C:\Users\Admin\Pictures\3TjNPrHEYJsK2j9r745JhVKu.exe"
                3⤵
                • Modifies firewall policy service
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Drops file in System32 directory
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:2000
              • C:\Users\Admin\Pictures\PGlMgFtEp0LNDygGTntTwmJD.exe
                "C:\Users\Admin\Pictures\PGlMgFtEp0LNDygGTntTwmJD.exe"
                3⤵
                • Executes dropped EXE
                PID:4808
                • C:\Users\Admin\AppData\Local\Temp\7zS9E9.tmp\Install.exe
                  .\Install.exe /nxdidQZJ "385118" /S
                  4⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Enumerates system info in registry
                  PID:1096
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    5⤵
                      PID:3532
                      • C:\Windows\SysWOW64\cmd.exe
                        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                          PID:3336
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                            7⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3584
                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                              8⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3660
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 05:16:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\qdcgIGr.exe\" em /pqsite_idaqM 385118 /S" /V1 /F
                        5⤵
                        • Drops file in Windows directory
                        • Creates scheduled task(s)
                        PID:3012
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3232 -ip 3232
                1⤵
                  PID:2144
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2404 -ip 2404
                  1⤵
                    PID:2420
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:4824
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                      1⤵
                        PID:5000
                      • C:\Windows\windefender.exe
                        C:\Windows\windefender.exe
                        1⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        PID:2092

                      Network

                      MITRE ATT&CK Matrix ATT&CK v13

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Persistence

                      Create or Modify System Process

                      2
                      T1543

                      Windows Service

                      2
                      T1543.003

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Privilege Escalation

                      Create or Modify System Process

                      2
                      T1543

                      Windows Service

                      2
                      T1543.003

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Scheduled Task/Job

                      1
                      T1053

                      Defense Evasion

                      Modify Registry

                      2
                      T1112

                      Virtualization/Sandbox Evasion

                      1
                      T1497

                      Impair Defenses

                      1
                      T1562

                      Disable or Modify System Firewall

                      1
                      T1562.004

                      Credential Access

                      Discovery

                      Query Registry

                      5
                      T1012

                      Virtualization/Sandbox Evasion

                      1
                      T1497

                      System Information Discovery

                      5
                      T1082

                      Lateral Movement

                      Collection

                      Exfiltration

                      Command and Control

                      Web Service

                      1
                      T1102

                      Impact

                      Resource Development

                      Reconnaissance

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\7zS9E9.tmp\Install.exe
                        Filesize

                        6.8MB

                        MD5

                        e77964e011d8880eae95422769249ca4

                        SHA1

                        8e15d7c4b7812a1da6c91738c7178adf0ff3200f

                        SHA256

                        f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50

                        SHA512

                        8feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\9fd8d771
                        Filesize

                        5.8MB

                        MD5

                        b96e10e36a9ef9a31b805f9749e57ae3

                        SHA1

                        bc39aa27931f264be23c4d603d5dbaf09ca8f37e

                        SHA256

                        ba11437b4ceb6ce1493ec4428eac92404425a4da52cfbe1292e4b2b325c90d02

                        SHA512

                        cb1c82e0ab8d89a0fe05ec5953fc0dbe16f38439155b6a585fdb2577c86dcfa55bfea0c88145123d9d3ab70ac7af09f6a5ee428e8aab0c1d184bbfdd836afda5

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
                        Filesize

                        14.6MB

                        MD5

                        9eba9ca5f06b484cbbe41ed6fb4a8768

                        SHA1

                        b52ea3b800254b0b1ae2f19e442fe98cc575eb18

                        SHA256

                        5836b09135b1b8060226a6dd32b23a3985cbef5ca17b97102a851d8b8aa2c689

                        SHA512

                        827f380f0d552b75be688c0de1bb6051c8d4cecf3784c6b396ce710b4c20b1b57c7eb16335cab93f451d7f69110df83f580dd562d1f26bbd2d7ca902e5c6ea74

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\UIxMarketPlugin.dll
                        Filesize

                        1.6MB

                        MD5

                        8f75e17a8bf3de6e22e77b5586f8a869

                        SHA1

                        e0bf196cfc19a8772e003b9058bdc211b419b261

                        SHA256

                        5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

                        SHA512

                        5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\UniversalInstaller.exe
                        Filesize

                        2.4MB

                        MD5

                        9fb4770ced09aae3b437c1c6eb6d7334

                        SHA1

                        fe54b31b0db8665aa5b22bed147e8295afc88a03

                        SHA256

                        a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

                        SHA512

                        140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\relay.dll
                        Filesize

                        1.5MB

                        MD5

                        7d2f87123e63950159fb2c724e55bdab

                        SHA1

                        360f304a6311080e1fead8591cb4659a8d135f2d

                        SHA256

                        b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

                        SHA512

                        6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\somebody.rtf
                        Filesize

                        24KB

                        MD5

                        ff36ebcf134c8846aea77446867e5bc6

                        SHA1

                        53fdf2c0bec711e377edb4f97cd147728fb568f6

                        SHA256

                        e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

                        SHA512

                        b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\ZXB_tls\spawn.xml
                        Filesize

                        1.2MB

                        MD5

                        0d4b3bef832fe7d161ec85f9a3ae2033

                        SHA1

                        98af2a1125bf6e1890ce6dab84834eecdef30d95

                        SHA256

                        422c6e1fec6485e29bbc20e3f74db6bc1d01be6acfbcaa10b7d9041e5fee8670

                        SHA512

                        730d1a012eaa109a87705c2b6a53280f99ca8361ad6186df7cd7bf452cbf748bc94e894c35e6cf0590014baf025a3061bce1107fb724922061afdcedf6e7b971

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ucnxlcx.sa5.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\ac722634
                        Filesize

                        1.4MB

                        MD5

                        4d68b109ca7863cf9afb159392161b21

                        SHA1

                        c4f0c50cf2a106419cb1f8e6631ad63af9ef51c3

                        SHA256

                        41829a2a54020e78bd5aca9a6ba80f8e8be8d2297754e3af346106287378ff54

                        SHA512

                        2e5a510014706f67893607ef82d43372d168f40d58c70dba3d818d00aee1f4d4aa8182cc7fa5c26ddba4d904252c578aae4f9522f8d1dc9653298cb1a75d9642

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        Filesize

                        281KB

                        MD5

                        d98e33b66343e7c96158444127a117f6

                        SHA1

                        bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                        SHA256

                        5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                        SHA512

                        705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                        Download Submit
                      • C:\Users\Admin\AppData\Local\Temp\u2h0.0.exe
                        Filesize

                        323KB

                        MD5

                        1d4341aa0ca4aefcb043d19eb205d8ac

                        SHA1

                        c6e7a063a22e6bad72b2c81017747ab31cb59579

                        SHA256

                        42af762221074082dc3aa6e4efdc2b6439cc026d6e94d6eeae97fcfafda272b4

                        SHA512

                        1bcc133000feb1ab7944295a14601ff1a66432dcbe117e9e60c9f98cb8aee5b28f0ddcbbc25e2b6d91b677ca67de32a8930a1317de9b8be17524a9bea43c73a7

                        Download Submit
                      • C:\Users\Admin\Pictures\3TjNPrHEYJsK2j9r745JhVKu.exe
                        Filesize

                        3.9MB

                        MD5

                        ffee05ea98b1d51026a44fad0841a8a9

                        SHA1

                        50a703329c7b9812c17a02b554cf406040079fec

                        SHA256

                        4cb040696b9ffb14794955b0e56eed04fde0cae3a5ee748dd513ad42c411c823

                        SHA512

                        626ddc18a906b74a231daa5bcc092a90708e0e3d42e4db645d59d19de7ef38a2d91a843f11dbc7873d379bfa14e87c5fc6d09a657e0b44abd24b9991cb971f86

                        Download Submit
                      • C:\Users\Admin\Pictures\6I64hwjvO3cAghk7nmA7AYb8.exe
                        Filesize

                        445KB

                        MD5

                        962689a584907a91344cd3427b586a04

                        SHA1

                        662bccdb6bd35082045778a68361dd3bf849dd57

                        SHA256

                        6abeb832e0ebffa3c8f166620d0aba275c0d51c4f75465e79a85716aead44cb4

                        SHA512

                        c9fa49f5c86498857c78ca833c847758b0e8b61db68454a5a5b3950332ac3f7238606f0ead0b1c288fcf82f7e450fb90b07f8770badac376bb8786caa755f6cb

                        Download Submit
                      • C:\Users\Admin\Pictures\HZ6p8GlFhdUDKSUiYOEyZl6j.exe
                        Filesize

                        4.2MB

                        MD5

                        12c1251ddacc8c6651573aaae2a36711

                        SHA1

                        aa4a4fc95f24a847f33a0fcc22d318fe947929d0

                        SHA256

                        a018166a731757f43374b0b24baecfbf31b85cf9de793b9d11b186acf887bf22

                        SHA512

                        e8e9723b210254504ae06f77ed86ff5c7da0ac1ba5134cb2ab99cd42b06744cdf2379835d5e8cbd413da69b1184a0d6297d29dc8393794d8959c5a2dc94f0a69

                        Download Submit
                      • C:\Users\Admin\Pictures\PGlMgFtEp0LNDygGTntTwmJD.exe
                        Filesize

                        6.4MB

                        MD5

                        aaa56797070369ad346fbd9bb6cc5e8b

                        SHA1

                        a1d01943f0a354d3a000628262671254ca6a91b8

                        SHA256

                        9d7d08ac35f0113f7c814d257bf88b8222975aaa0a3fdeda88ac7185dbc50905

                        SHA512

                        e69d25a158567c6bce6e9450de17d0814b9b9c11f4bb31e5dcc3e8b4378062cc7e31da625f6ba4a2280b393034a6c832a0fc0a1e16364dc7e8c8146de245b5be

                        Download Submit
                      • C:\Users\Admin\Pictures\odbuPwdi80k3YYNspErunO5j.exe
                        Filesize

                        7KB

                        MD5

                        5b423612b36cde7f2745455c5dd82577

                        SHA1

                        0187c7c80743b44e9e0c193e993294e3b969cc3d

                        SHA256

                        e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                        SHA512

                        c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                        Filesize

                        2KB

                        MD5

                        ac4917a885cf6050b1a483e4bc4d2ea5

                        SHA1

                        b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f

                        SHA256

                        e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9

                        SHA512

                        092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        db1338e06b40e83d02804c849869fd88

                        SHA1

                        74faa550e54ea37c4079f12779a8cdc82ba34aa4

                        SHA256

                        5db9810f1cababd73799681a1eeec006338bfbcb738c1e2d62b1a5b78e998c35

                        SHA512

                        df72d7616e0ed82022adc0eb0380ccc6d028f63a3401df7514a64e174d571406fe1ef51de7761d99ac4ad2ba9fda584643af9c5c9d81a0771c13dde4b779f958

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        745899c7771eb19fc876793cca402a41

                        SHA1

                        6c65c6fd59799dc680b0494a2f249b417f7d74da

                        SHA256

                        83b4bb22c688379bde90f00f7ff0e9c0632c30ed02fece6a7a21efb37eeb2a63

                        SHA512

                        8e4a242cbbdbcdd886d2b5dec36bbb1c4adcf25e776bb363353fdcf913f5f3542551b6ad8955f0e4ddb9a4a39e1f1fbcd1c9564d71c963e9ff6ff35ade20766f

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        45b98e412d86aa75e7da998586779bab

                        SHA1

                        4dc2f97f92906ae58a0c9f1bee5d777644c0785d

                        SHA256

                        0eea1aa3e5b7c65b0227fc97b480e438563d82937c70005836ed5853b4e47568

                        SHA512

                        51f50ea199a3f19236d862e4827feff41d138e3f6ab58e6e358630d50daccf23eba5b0661383a72c29984c4e87feeb417cc7746a154b51a9eb4dfce19d52882b

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        82c51a491781ed87a90be07d40431b59

                        SHA1

                        bb09ebacf10b71980f1ac7d267f807c81bfa23fc

                        SHA256

                        015bfa0793e4f37c0499702d12ece87aadb5ef13493c6f2e5795ddc896dcb601

                        SHA512

                        fad757b346ef89bc59450dca39cac4a8d233ef4f9aabb09e508fc930ea3aa4cd8717cceb27bc30fd52cf7c63fbb482684bd82de98f9bb31ea9f434875d03e482

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        01621b22cd937a24bc87793665cfdf30

                        SHA1

                        1f8e06bb8a7c989299146ecc2e97c4153d00c8a3

                        SHA256

                        fedf737f5679a26b400bdc5349589b7152f6a1ea119aeeab35183b6b71981110

                        SHA512

                        fe44c06547bbb6ecefa0cad2de446c21b3fdc5b1e7ac51ff9f2f04353d0d75bbc1a55f12c3caf1e5d0965f53ab8304842103136df5632ae7ad59e76aad86f35f

                        Download Submit
                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                        Filesize

                        19KB

                        MD5

                        4b0ea2e114aecbc9dec16d994c0b51d1

                        SHA1

                        38bd1bb8ea228df3ac9c6ebc71e911255966d6be

                        SHA256

                        15a9a55d478726578fca58ee95acf7ff0de6d626e5fdb2cec5a40a84438611ef

                        SHA512

                        130ace8861cd7053bb1efaaf28ba17c34027c62741b5ceb78513833621e9698091b753d0c34264cc363a8505fb0a9c5fbe76371c4e9bff2205588e51f88bf208

                        Download Submit
                      • C:\Windows\System32\GroupPolicy\gpt.ini
                        Filesize

                        127B

                        MD5

                        8ef9853d1881c5fe4d681bfb31282a01

                        SHA1

                        a05609065520e4b4e553784c566430ad9736f19f

                        SHA256

                        9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                        SHA512

                        5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                        Download Submit
                      • C:\Windows\windefender.exe
                        Filesize

                        2.0MB

                        MD5

                        8e67f58837092385dcf01e8a2b4f5783

                        SHA1

                        012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                        SHA256

                        166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                        SHA512

                        40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                        Download Submit
                      • memory/1028-507-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1028-484-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1028-492-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1028-500-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1028-426-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1028-449-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1028-514-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1764-324-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1764-176-0x0000000003B60000-0x0000000003F60000-memory.dmp
                        Filesize

                        4.0MB

                        Download
                      • memory/1764-425-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/1932-479-0x0000000000400000-0x00000000008DF000-memory.dmp
                        Filesize

                        4.9MB

                        Download
                      • memory/2000-485-0x00007FF66B590000-0x00007FF66C099000-memory.dmp
                        Filesize

                        11.0MB

                        Download
                      • memory/2000-451-0x00007FF66B590000-0x00007FF66C099000-memory.dmp
                        Filesize

                        11.0MB

                        Download
                      • memory/2000-457-0x00007FF66B590000-0x00007FF66C099000-memory.dmp
                        Filesize

                        11.0MB

                        Download
                      • memory/2000-458-0x00007FF66B590000-0x00007FF66C099000-memory.dmp
                        Filesize

                        11.0MB

                        Download
                      • memory/2000-459-0x00007FF66B590000-0x00007FF66C099000-memory.dmp
                        Filesize

                        11.0MB

                        Download
                      • memory/2000-461-0x00007FF66B590000-0x00007FF66C099000-memory.dmp
                        Filesize

                        11.0MB

                        Download
                      • memory/2092-488-0x0000000000400000-0x00000000008DF000-memory.dmp
                        Filesize

                        4.9MB

                        Download
                      • memory/2092-504-0x0000000000400000-0x00000000008DF000-memory.dmp
                        Filesize

                        4.9MB

                        Download
                      • memory/2152-99-0x0000000005080000-0x0000000005090000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/2152-0-0x0000000000400000-0x0000000000408000-memory.dmp
                        Filesize

                        32KB

                        Download
                      • memory/2152-70-0x0000000074D70000-0x0000000075521000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/2152-2-0x0000000005080000-0x0000000005090000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/2152-1-0x0000000074D70000-0x0000000075521000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/2404-96-0x0000000005FD0000-0x000000000601C000-memory.dmp
                        Filesize

                        304KB

                        Download
                      • memory/2404-132-0x0000000007580000-0x000000000759A000-memory.dmp
                        Filesize

                        104KB

                        Download
                      • memory/2404-64-0x0000000002C00000-0x0000000002C10000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/2404-63-0x0000000002790000-0x00000000027C6000-memory.dmp
                        Filesize

                        216KB

                        Download
                      • memory/2404-66-0x00000000052F0000-0x000000000591A000-memory.dmp
                        Filesize

                        6.2MB

                        Download
                      • memory/2404-65-0x0000000074D70000-0x0000000075521000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/2404-67-0x0000000005120000-0x0000000005142000-memory.dmp
                        Filesize

                        136KB

                        Download
                      • memory/2404-68-0x00000000051C0000-0x0000000005226000-memory.dmp
                        Filesize

                        408KB

                        Download
                      • memory/2404-69-0x0000000005A90000-0x0000000005AF6000-memory.dmp
                        Filesize

                        408KB

                        Download
                      • memory/2404-82-0x0000000002C00000-0x0000000002C10000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/2404-90-0x0000000005B00000-0x0000000005E57000-memory.dmp
                        Filesize

                        3.3MB

                        Download
                      • memory/2404-91-0x0000000005FA0000-0x0000000005FBE000-memory.dmp
                        Filesize

                        120KB

                        Download
                      • memory/2404-101-0x00000000063D0000-0x0000000006416000-memory.dmp
                        Filesize

                        280KB

                        Download
                      • memory/2404-115-0x00000000073C0000-0x00000000073F4000-memory.dmp
                        Filesize

                        208KB

                        Download
                      • memory/2404-117-0x000000006F360000-0x000000006F6B7000-memory.dmp
                        Filesize

                        3.3MB

                        Download
                      • memory/2404-129-0x000000007F800000-0x000000007F810000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/2404-130-0x0000000007440000-0x00000000074E4000-memory.dmp
                        Filesize

                        656KB

                        Download
                      • memory/2404-128-0x0000000007420000-0x000000000743E000-memory.dmp
                        Filesize

                        120KB

                        Download
                      • memory/2404-116-0x000000006F310000-0x000000006F35C000-memory.dmp
                        Filesize

                        304KB

                        Download
                      • memory/2404-134-0x0000000074D70000-0x0000000075521000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/2404-131-0x0000000007BD0000-0x000000000824A000-memory.dmp
                        Filesize

                        6.5MB

                        Download
                      • memory/2404-133-0x00000000075C0000-0x00000000075CA000-memory.dmp
                        Filesize

                        40KB

                        Download
                      • memory/3204-118-0x0000000000400000-0x0000000001A3A000-memory.dmp
                        Filesize

                        22.2MB

                        Download
                      • memory/3204-102-0x0000000001DD0000-0x0000000001ED0000-memory.dmp
                        Filesize

                        1024KB

                        Download
                      • memory/3204-17-0x0000000001DD0000-0x0000000001ED0000-memory.dmp
                        Filesize

                        1024KB

                        Download
                      • memory/3204-19-0x0000000000400000-0x0000000001A3A000-memory.dmp
                        Filesize

                        22.2MB

                        Download
                      • memory/3204-18-0x0000000003770000-0x00000000037DE000-memory.dmp
                        Filesize

                        440KB

                        Download
                      • memory/3232-60-0x0000000001C80000-0x0000000001D80000-memory.dmp
                        Filesize

                        1024KB

                        Download
                      • memory/3232-114-0x0000000000400000-0x0000000001A1C000-memory.dmp
                        Filesize

                        22.1MB

                        Download
                      • memory/3232-62-0x0000000000400000-0x0000000001A1C000-memory.dmp
                        Filesize

                        22.1MB

                        Download
                      • memory/3232-61-0x0000000003620000-0x0000000003647000-memory.dmp
                        Filesize

                        156KB

                        Download
                      • memory/3392-47-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/3392-45-0x0000000003B90000-0x0000000003F94000-memory.dmp
                        Filesize

                        4.0MB

                        Download
                      • memory/3392-46-0x0000000003FA0000-0x000000000488B000-memory.dmp
                        Filesize

                        8.9MB

                        Download
                      • memory/3392-119-0x0000000003B90000-0x0000000003F94000-memory.dmp
                        Filesize

                        4.0MB

                        Download
                      • memory/3392-150-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/4428-159-0x0000000004D60000-0x0000000004D70000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/4428-162-0x0000000004D60000-0x0000000004D70000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/4428-157-0x0000000074D70000-0x0000000075521000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/4964-323-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/4964-152-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/4964-287-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/4964-151-0x0000000003BD0000-0x0000000003FC9000-memory.dmp
                        Filesize

                        4.0MB

                        Download
                      • memory/4976-148-0x00000000077C0000-0x0000000007864000-memory.dmp
                        Filesize

                        656KB

                        Download
                      • memory/4976-112-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/4976-153-0x00000000079E0000-0x0000000007A76000-memory.dmp
                        Filesize

                        600KB

                        Download
                      • memory/4976-156-0x0000000007990000-0x000000000799E000-memory.dmp
                        Filesize

                        56KB

                        Download
                      • memory/4976-173-0x0000000074D70000-0x0000000075521000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/4976-170-0x0000000007A90000-0x0000000007A98000-memory.dmp
                        Filesize

                        32KB

                        Download
                      • memory/4976-138-0x000000006F360000-0x000000006F6B7000-memory.dmp
                        Filesize

                        3.3MB

                        Download
                      • memory/4976-169-0x0000000007AA0000-0x0000000007ABA000-memory.dmp
                        Filesize

                        104KB

                        Download
                      • memory/4976-149-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/4976-139-0x000000007F3C0000-0x000000007F3D0000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/4976-137-0x000000006F310000-0x000000006F35C000-memory.dmp
                        Filesize

                        304KB

                        Download
                      • memory/4976-108-0x0000000074D70000-0x0000000075521000-memory.dmp
                        Filesize

                        7.7MB

                        Download
                      • memory/4976-113-0x0000000004ED0000-0x0000000004EE0000-memory.dmp
                        Filesize

                        64KB

                        Download
                      • memory/4976-154-0x0000000007950000-0x0000000007961000-memory.dmp
                        Filesize

                        68KB

                        Download
                      • memory/4976-158-0x00000000079A0000-0x00000000079B5000-memory.dmp
                        Filesize

                        84KB

                        Download
                      • memory/4992-100-0x0000000000400000-0x0000000001DF9000-memory.dmp
                        Filesize

                        26.0MB

                        Download
                      • memory/4992-177-0x0000000003B20000-0x0000000003F25000-memory.dmp
                        Filesize

                        4.0MB

                        Download
                      • memory/4992-98-0x0000000003F30000-0x000000000481B000-memory.dmp
                        Filesize

                        8.9MB

                        Download
                      • memory/4992-97-0x0000000003B20000-0x0000000003F25000-memory.dmp
                        Filesize

                        4.0MB

                        Download