Overview

overview

10

Static

static

1

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    83s
  • max time network
    309s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-05-2024 22:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2dd429b06b920140fe9186608b47d7d80697191b089117769912d81f6c39ff38.exe

  • Size

    392KB

  • MD5

    ccc754d02cc1188f0a0477b306539065

  • SHA1

    8a73b2e84fbdcadfaa98cc325c2222096bdc309b

  • SHA256

    2dd429b06b920140fe9186608b47d7d80697191b089117769912d81f6c39ff38

  • SHA512

    6cabd1b19ddd94280528e4c2512e222bacc9bea6806e1df5610ffd3d993f52c4599e65fc7573d3d426e4d6d8c3756244e3e242b55b499796222f971b15ca8e0a

  • SSDEEP

    6144:htbMqLyDywnR6E5qkDPWQo9f+1llNEaVl5CMba/W1i5adCexXadKxQ3qhqrS8PbH:ht4qLC7RFfT7Ew5Csfi5advxaVkk

Score
10/10
gluptebastealczgratdiscoverydropperevasionexecutionloaderpersistenceratspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 29 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 10 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Drops startup file 6 IoCs
  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 10 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 12 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dd429b06b920140fe9186608b47d7d80697191b089117769912d81f6c39ff38.exe
    "C:\Users\Admin\AppData\Local\Temp\2dd429b06b920140fe9186608b47d7d80697191b089117769912d81f6c39ff38.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4656
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2dd429b06b920140fe9186608b47d7d80697191b089117769912d81f6c39ff38.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:892
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
      2⤵
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Users\Admin\Pictures\77wuYEZExU0KksC2aXOc28on.exe
        "C:\Users\Admin\Pictures\77wuYEZExU0KksC2aXOc28on.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4676
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1972
        • C:\Users\Admin\Pictures\77wuYEZExU0KksC2aXOc28on.exe
          "C:\Users\Admin\Pictures\77wuYEZExU0KksC2aXOc28on.exe"
          4⤵
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5832
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6024
          • C:\Windows\System32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:5300
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:4256
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              PID:2276
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:4644
        • C:\Users\Admin\Pictures\xFohppZnTpRXQIdjsvE5duLP.exe
          "C:\Users\Admin\Pictures\xFohppZnTpRXQIdjsvE5duLP.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3764
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3232
          • C:\Users\Admin\Pictures\xFohppZnTpRXQIdjsvE5duLP.exe
            "C:\Users\Admin\Pictures\xFohppZnTpRXQIdjsvE5duLP.exe"
            4⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5884
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6068
            • C:\Windows\System32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
                PID:1188
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  PID:5492
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:684
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:5568
          • C:\Users\Admin\Pictures\cbMzO28ECyxBfQTqWL5WGpxG.exe
            "C:\Users\Admin\Pictures\cbMzO28ECyxBfQTqWL5WGpxG.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2556
            • C:\Users\Admin\AppData\Local\Temp\u1z0.0.exe
              "C:\Users\Admin\AppData\Local\Temp\u1z0.0.exe"
              4⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:2600
            • C:\Users\Admin\AppData\Local\Temp\u1z0.1.exe
              "C:\Users\Admin\AppData\Local\Temp\u1z0.1.exe"
              4⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:5904
              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                5⤵
                  PID:5256
            • C:\Users\Admin\Pictures\e1TUuqX2IUVzeUs2xcCkN7vU.exe
              "C:\Users\Admin\Pictures\e1TUuqX2IUVzeUs2xcCkN7vU.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4356
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2028
              • C:\Users\Admin\Pictures\e1TUuqX2IUVzeUs2xcCkN7vU.exe
                "C:\Users\Admin\Pictures\e1TUuqX2IUVzeUs2xcCkN7vU.exe"
                4⤵
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:5696
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6072
                • C:\Windows\System32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:5308
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:5416
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1556
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    5⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6020
                  • C:\Windows\rss\csrss.exe
                    C:\Windows\rss\csrss.exe
                    5⤵
                    • Executes dropped EXE
                    PID:4496
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1180
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      6⤵
                      • Creates scheduled task(s)
                      PID:5848
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /delete /tn ScheduledUpdate /f
                      6⤵
                        PID:4156
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5860
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:5276
                      • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                        6⤵
                          PID:6020
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                          6⤵
                          • Creates scheduled task(s)
                          PID:2204
                        • C:\Windows\windefender.exe
                          "C:\Windows\windefender.exe"
                          6⤵
                            PID:1036
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              7⤵
                                PID:6000
                                • C:\Windows\SysWOW64\sc.exe
                                  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  8⤵
                                  • Launches sc.exe
                                  PID:5888
                      • C:\Users\Admin\Pictures\NmxtPpHgG8c5AwLshRN2JfZz.exe
                        "C:\Users\Admin\Pictures\NmxtPpHgG8c5AwLshRN2JfZz.exe"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1472
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          4⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3236
                        • C:\Users\Admin\Pictures\NmxtPpHgG8c5AwLshRN2JfZz.exe
                          "C:\Users\Admin\Pictures\NmxtPpHgG8c5AwLshRN2JfZz.exe"
                          4⤵
                          • Windows security bypass
                          • Executes dropped EXE
                          • Windows security modification
                          • Adds Run key to start application
                          • Checks for VirtualBox DLLs, possible anti-VM trick
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:5740
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6052
                          • C:\Windows\System32\cmd.exe
                            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                            5⤵
                              PID:5256
                              • C:\Windows\system32\netsh.exe
                                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                6⤵
                                • Modifies Windows Firewall
                                PID:5356
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              5⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4092
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              5⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in System32 directory
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5388
                        • C:\Users\Admin\Pictures\cPYfY5Ucexb6Agj3qp1nyyFl.exe
                          "C:\Users\Admin\Pictures\cPYfY5Ucexb6Agj3qp1nyyFl.exe"
                          3⤵
                            PID:4716
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                          2⤵
                            PID:1432
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                          1⤵
                            PID:5740
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                            1⤵
                              PID:320
                            • C:\Windows\windefender.exe
                              C:\Windows\windefender.exe
                              1⤵
                                PID:932

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              PowerShell

                              1
                              T1059.001

                              Scheduled Task/Job

                              1
                              T1053

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Privilege Escalation

                              Abuse Elevation Control Mechanism

                              1
                              T1548

                              Bypass User Account Control

                              1
                              T1548.002

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Defense Evasion

                              Abuse Elevation Control Mechanism

                              1
                              T1548

                              Bypass User Account Control

                              1
                              T1548.002

                              Impair Defenses

                              4
                              T1562

                              Disable or Modify System Firewall

                              1
                              T1562.004

                              Disable or Modify Tools

                              3
                              T1562.001

                              Modify Registry

                              5
                              T1112

                              Credential Access

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Peripheral Device Discovery

                              1
                              T1120

                              Query Registry

                              3
                              T1012

                              System Information Discovery

                              5
                              T1082

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Are.docx
                                Filesize

                                11KB

                                MD5

                                a33e5b189842c5867f46566bdbf7a095

                                SHA1

                                e1c06359f6a76da90d19e8fd95e79c832edb3196

                                SHA256

                                5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                SHA512

                                f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                Filesize

                                2KB

                                MD5

                                1c19c16e21c97ed42d5beabc93391fc5

                                SHA1

                                8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                SHA256

                                1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                SHA512

                                7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                19KB

                                MD5

                                b736aaebe529340591a1d0f49c05d80f

                                SHA1

                                8c3c8a3d4ecee21412c18c95cdbda8396d543634

                                SHA256

                                bc4fccedfbec4de5915627a2c5d732ffdb2e0ac3a1cc0fcff92ca7b20636991d

                                SHA512

                                dbf7401abd2d2365f79e338da0ee6dc4c4398f008f9d2d09a844c63e7484b37f240b33e787f82e4dfbd57dbdc26566667713716178ba077e14d026dbf78451ae

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                19KB

                                MD5

                                fa9df7031d684fc8e8bb765e2a50d48b

                                SHA1

                                b34f723c8dfe45c60d88241f8e33f84c996b20e1

                                SHA256

                                8f56c2ed7963f9c40bfdefc0e214473ee3eded9937b3b0dd31e41453297ff9e1

                                SHA512

                                72f8060623a233fd6388ed92bc8f27ba7541fc682df5921e801ae32e5824a578464422677d9f3d0cfbf9c22b7f1235a0e9a0947fe45ffb9f7fd51e454c90c4e1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                19KB

                                MD5

                                23a417bba426decb34963539601fb836

                                SHA1

                                b8cdcb04f2a55193749ba3bb7166b29f88112308

                                SHA256

                                52e9c5d9a66c5f3547ab176394180397a0f5a39a75ded7bec47d0207b04ee993

                                SHA512

                                5d2f76022d9057c90af4331674172b071171dbe45eec2fa0488fde4e95a364f604a0de018baae670ecf2b0dab402003772fc8caa552ac9340120d350fc7c807d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kts1t50q.bz3.ps1
                                Filesize

                                1B

                                MD5

                                c4ca4238a0b923820dcc509a6f75849b

                                SHA1

                                356a192b7913b04c54574d18c28d46e6395428ab

                                SHA256

                                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                SHA512

                                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                Filesize

                                281KB

                                MD5

                                d98e33b66343e7c96158444127a117f6

                                SHA1

                                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                SHA256

                                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                SHA512

                                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                Filesize

                                2KB

                                MD5

                                cb8ddb13ce51ade44a9aeb9c4d5d9c74

                                SHA1

                                1ae0065ec1e37d8b44e30e5326af8f517fe8e1a5

                                SHA256

                                8e1b9330dab6e2d36f83f658a1cf51c31eb1a519580e9b15eb6532a4a4e90884

                                SHA512

                                fb1927779a1f03e7a0cdc0fe5bfa88a9fc25b736f7934d2c9e00e4d220e7a546b53f92ef70e90312a79826c49e7f9fe9b6b16e931b74b26b7df47af247496bb0

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\u1z0.0.exe
                                Filesize

                                282KB

                                MD5

                                f72e01dfb65e6409cb0fc611e466e9d5

                                SHA1

                                e3d9f9d5e531ea1537bbecbf8064c5772a3c4a26

                                SHA256

                                7eec5c68ccc964cae08684c73b65a0427623454286b253b4ee4453dc1aa93bbf

                                SHA512

                                7f47b5e7d997d923ca3d2a481bd8754b01c444c3be284b01e8577e58632bf1b69db87927e57079999e9ffc4dc1d50c45b68a5ce3b4ad58bdcf55d48acb9a87c1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\u1z0.1.exe
                                Filesize

                                4.6MB

                                MD5

                                397926927bca55be4a77839b1c44de6e

                                SHA1

                                e10f3434ef3021c399dbba047832f02b3c898dbd

                                SHA256

                                4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                                SHA512

                                cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                                Download Submit

                              • C:\Users\Admin\Pictures\77wuYEZExU0KksC2aXOc28on.exe
                                Filesize

                                4.2MB

                                MD5

                                61ea29403f696bdb529abfed16a6cef4

                                SHA1

                                57aaf7b5fa7765bc42a4391a640502d30b6432b1

                                SHA256

                                944c792b16309c7461018d999d0831a2d299b19f81015da489d77d1445ac24da

                                SHA512

                                04eb6d2e7944a80ead6eb58a019aef33900c142e7cfd156c215d94f879d5d1586ce451aa40dc5e8f0b9d78a503be967301e89dfc65f85e639e1dc94cfa021004

                                Download Submit

                              • C:\Users\Admin\Pictures\NmxtPpHgG8c5AwLshRN2JfZz.exe
                                Filesize

                                4.2MB

                                MD5

                                d42f70bc211153abcc56b7b550d8f066

                                SHA1

                                2e79143fa90a058e56dad12920f2d450cc138098

                                SHA256

                                f1ad483fb40354a1d2c9f1b8ed46ae799fc67433af0a6ff0393c59939f752d4f

                                SHA512

                                c10085de5476de153204a08c7e66245fa729922f118f6a2567ec547097effe710c31d0f626aedae4af1a971e3594fd7cf2544d353168f931ed4ab9dc99f12c79

                                Download Submit

                              • C:\Users\Admin\Pictures\cPYfY5Ucexb6Agj3qp1nyyFl.exe
                                Filesize

                                5.5MB

                                MD5

                                26193ade61357f8be316a489dfbe08c7

                                SHA1

                                12f618f5c00f81477f7dfbb513d88c66166e1aed

                                SHA256

                                cd08d7d53e4206301c103aa6db8cf423e289679a203973a0c7c13404e7490e48

                                SHA512

                                881f6cbd27adf3f038a6ae2c9ee20af97ba0502c775d95bbc47d1a605691bdc3158129fa6123b9256202d34d40e48e90a1e7863d0d1c03d0e3672bada6c61c9a

                                Download Submit

                              • C:\Users\Admin\Pictures\cbMzO28ECyxBfQTqWL5WGpxG.exe
                                Filesize

                                423KB

                                MD5

                                7e082a8f4b814df02d2492b92ba08679

                                SHA1

                                ebc6c49b269bcf96a64f198353efbc26564e0103

                                SHA256

                                788b07ddb4703999ebce7d1ea6de760f99667a6d2f3e905932c913d689c83ae2

                                SHA512

                                88a94cf73ba5311361f264c80419af3ba85c953cf6a486b042f949f5e0331f5c3a7a44a7afa20d4184fa990b030a04dfb5d3a7f9146d33a49ff84add0c57253a

                                Download Submit

                              • C:\Users\Admin\Pictures\xgGfFOcBUj88lukiVB5fOzS1.exe
                                Filesize

                                7KB

                                MD5

                                77f762f953163d7639dff697104e1470

                                SHA1

                                ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                                SHA256

                                d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                                SHA512

                                d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                Filesize

                                2KB

                                MD5

                                db01a2c1c7e70b2b038edf8ad5ad9826

                                SHA1

                                540217c647a73bad8d8a79e3a0f3998b5abd199b

                                SHA256

                                413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

                                SHA512

                                c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                18KB

                                MD5

                                2692414a38eefb1363c479ea692b7859

                                SHA1

                                5bfb945d267bd5f9a6181e313d8159e313d8d6c5

                                SHA256

                                055dc44ca5096015fa9f1b31825594defe82869dfb4aef7f447c3d63b8c9df39

                                SHA512

                                1d4218ed72cb7419bcf20d17054d87db5bf055dccedd81f73480d80a79bd78086266d7777e3f7600fc536887e58a906ceb960fbb597c0a0c2a84cac750cd5c44

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                18KB

                                MD5

                                c165a2b75440b256d25f7ddb3a589f24

                                SHA1

                                ab4772f3d9fe962c79b4c055bb60b549676a4290

                                SHA256

                                f575bd61315f343db8b256104c7a5b7fdaaefb7263eb4de0ffffe434e4eda58f

                                SHA512

                                f10edb21edc8981e9b32f55c8b7c0edbef330ffe3c60bee1655b9baa38f1c8a76b7568802108ef792f215340b35aa8ceb6a9115ac6e5b120e31f92a04b1ecf60

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                18KB

                                MD5

                                74f77cbe58d89e153d7439c877ce1e48

                                SHA1

                                5a4beaa8489f81639670ad50232ffed2fddaf465

                                SHA256

                                337e48729544249cd4fa66ae260ad71bc15542048b2bb8641f7d2fafc93e530b

                                SHA512

                                901db4cc34bcd5f81fe8a469f4e6f2294b2921a14434bd3ea9c81ff5ddb79810494cbf572ac0ad154b6cf26261c55f3792d64a0176ca0db4131bc1baf92646d2

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                18KB

                                MD5

                                1214768e4ee89d71e77e3d6b1679f043

                                SHA1

                                4b079053a4dfcf11a9eb3be3b416ac21ade9b0b4

                                SHA256

                                7d6baf62c414dc7969e1c2cc72a3febb9b61fa441c75e441eb5ccfde4e816c3b

                                SHA512

                                998947098c158e6e118492852243d8b4ea259cdbd76e62844cde25e2829b505a1586f032a677469cf5a6c48b351320e3b8c7b968fdd2b0d968476781f8cd83de

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                18KB

                                MD5

                                4631af7fde48f6289ae704b0075f3970

                                SHA1

                                705f821bd52ea5af645093a354ec54399f63a9fe

                                SHA256

                                f9758da4f416ec4bdd70815918c82d8d36f2154c0aa33e3582d155e0587c2bb6

                                SHA512

                                c06f2c595a861ea23ca65fc31dd43ea50ebea8f3555e673b6338e688a0dbc4155a2e80f1b7508b25140f4e42d9a4464e7e0404284888cc1842964c49d0d6e20e

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                18KB

                                MD5

                                f2d79af99be05b5b3b64248285028bc0

                                SHA1

                                7bd8d6b51bf6513985db74e1abde9ab1d647951d

                                SHA256

                                b1c9981171a819c6e994d7a9be68c00b8fa283ea133909933972dc048fac9341

                                SHA512

                                c71826c9c99e2e24909255284d00598536a130cfe88a0425b9d2a4dba262403e5364a511691fe49eb0aa05c0377ae27aac91bff1704735aab099b482f1e8d8ce

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                18KB

                                MD5

                                6120ca9321d78e944d8c373180903f9e

                                SHA1

                                58a67375940b6ec0de63c3a57348534abc1f666b

                                SHA256

                                892d94871f81c5aa7e8e1cd8ebec4d76a91e2ccf06a37754d5cac4b3f226181a

                                SHA512

                                14696bcca9838afa9660838c521ee8a7de98546b3bf5e02a8246bf6e93a0a85af364e99f4b69bbcfcbeb4d823979c80329bbeac868117ec7e298a650bf798789

                                Download Submit

                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                Filesize

                                18KB

                                MD5

                                34469a0a089cffc472bbf57ebefabdd3

                                SHA1

                                8ac67767eec3931cab721bcfdeef113b798d60b1

                                SHA256

                                cc8df870896a2aa0cbbca128a6d77cfbcbfd4ce7b587fda2b088954b253b35b3

                                SHA512

                                03f0fddccb5e2c5c0eda37a93292201708fed6822df19b226186a9a5d571ab4c9e4aaaf4110243e00f23c79ecd36bbc0d8522273b8d5550a31097729f692c548

                                Download Submit

                              • C:\Windows\System32\GroupPolicy\gpt.ini
                                Filesize

                                127B

                                MD5

                                8ef9853d1881c5fe4d681bfb31282a01

                                SHA1

                                a05609065520e4b4e553784c566430ad9736f19f

                                SHA256

                                9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

                                SHA512

                                5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

                                Download Submit

                              • C:\Windows\windefender.exe
                                Filesize

                                2.0MB

                                MD5

                                8e67f58837092385dcf01e8a2b4f5783

                                SHA1

                                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                SHA256

                                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                SHA512

                                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                Download Submit

                              • memory/684-2402-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/684-2405-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/892-11-0x000001ABC7990000-0x000001ABC79B2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/892-12-0x00007FFE5C980000-0x00007FFE5D36C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/892-55-0x00007FFE5C980000-0x00007FFE5D36C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/892-16-0x000001ABAF380000-0x000001ABAF390000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/892-17-0x000001ABC7B40000-0x000001ABC7BB6000-memory.dmp

                                Filesize

                                472KB

                                Download

                              • memory/892-10-0x00007FFE5C980000-0x00007FFE5D36C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/1036-4762-0x0000000000400000-0x00000000008DF000-memory.dmp

                                Filesize

                                4.9MB

                                Download

                              • memory/1180-3987-0x000000006E1F0000-0x000000006E540000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/1180-3986-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/1180-3992-0x0000000009BF0000-0x0000000009C95000-memory.dmp

                                Filesize

                                660KB

                                Download

                              • memory/1180-3966-0x00000000080B0000-0x0000000008400000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/1472-580-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/1472-1262-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/1556-2413-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/1556-2412-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/1972-112-0x00000000072F0000-0x0000000007312000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/1972-365-0x000000006F3A0000-0x000000006F6F0000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/1972-364-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/1972-116-0x0000000008080000-0x000000000809C000-memory.dmp

                                Filesize

                                112KB

                                Download

                              • memory/2028-115-0x0000000007E60000-0x00000000081B0000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/2028-1160-0x00000000087E0000-0x00000000087E8000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/2028-1111-0x00000000087F0000-0x000000000880A000-memory.dmp

                                Filesize

                                104KB

                                Download

                              • memory/2028-114-0x0000000007DF0000-0x0000000007E56000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2028-113-0x0000000007C80000-0x0000000007CE6000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2028-353-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/2028-354-0x000000006F3A0000-0x000000006F6F0000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/2028-171-0x00000000093A0000-0x00000000093DC000-memory.dmp

                                Filesize

                                240KB

                                Download

                              • memory/2028-117-0x0000000008330000-0x000000000837B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/2028-210-0x0000000009460000-0x00000000094D6000-memory.dmp

                                Filesize

                                472KB

                                Download

                              • memory/2276-2982-0x0000000002600000-0x00000000026AE000-memory.dmp

                                Filesize

                                696KB

                                Download

                              • memory/2556-578-0x0000000000400000-0x0000000001A34000-memory.dmp

                                Filesize

                                22.2MB

                                Download

                              • memory/2556-1384-0x0000000000400000-0x0000000001A34000-memory.dmp

                                Filesize

                                22.2MB

                                Download

                              • memory/2600-1228-0x0000000000400000-0x0000000001A10000-memory.dmp

                                Filesize

                                22.1MB

                                Download

                              • memory/2600-1229-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                Filesize

                                972KB

                                Download

                              • memory/2600-1281-0x0000000000400000-0x0000000001A10000-memory.dmp

                                Filesize

                                22.1MB

                                Download

                              • memory/2600-4767-0x0000000000400000-0x0000000001A10000-memory.dmp

                                Filesize

                                22.1MB

                                Download

                              • memory/2600-4750-0x0000000000400000-0x0000000001A10000-memory.dmp

                                Filesize

                                22.1MB

                                Download

                              • memory/3232-341-0x000000006F3A0000-0x000000006F6F0000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/3232-338-0x000000000A6B0000-0x000000000A6E3000-memory.dmp

                                Filesize

                                204KB

                                Download

                              • memory/3232-342-0x000000000A690000-0x000000000A6AE000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/3232-339-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/3232-111-0x0000000007A50000-0x0000000008078000-memory.dmp

                                Filesize

                                6.2MB

                                Download

                              • memory/3232-106-0x00000000072B0000-0x00000000072E6000-memory.dmp

                                Filesize

                                216KB

                                Download

                              • memory/3232-348-0x000000000A6F0000-0x000000000A795000-memory.dmp

                                Filesize

                                660KB

                                Download

                              • memory/3236-347-0x000000006F3A0000-0x000000006F6F0000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/3236-340-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/3236-363-0x0000000009C10000-0x0000000009CA4000-memory.dmp

                                Filesize

                                592KB

                                Download

                              • memory/3764-575-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/3764-1259-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/3764-1227-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4092-2321-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/4092-2327-0x0000000008F30000-0x0000000008FD5000-memory.dmp

                                Filesize

                                660KB

                                Download

                              • memory/4092-2322-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/4180-15-0x0000000073B3E000-0x0000000073B3F000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4180-2261-0x0000000073B3E000-0x0000000073B3F000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4180-8-0x0000000000400000-0x0000000000408000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/4356-1261-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4356-579-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4496-4757-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4496-4445-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4496-4730-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4644-3222-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/4644-3221-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/4656-2-0x000001C4F5630000-0x000001C4F563A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/4656-0-0x00007FFE5C983000-0x00007FFE5C984000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4656-1665-0x00007FFE5C980000-0x00007FFE5D36C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/4656-3-0x000001C4DCF00000-0x000001C4DCF5E000-memory.dmp

                                Filesize

                                376KB

                                Download

                              • memory/4656-4-0x00007FFE5C980000-0x00007FFE5D36C000-memory.dmp

                                Filesize

                                9.9MB

                                Download

                              • memory/4656-1-0x000001C4DB270000-0x000001C4DB27A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/4656-1265-0x00007FFE5C983000-0x00007FFE5C984000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4676-574-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4676-1226-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4676-1258-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/4716-4707-0x0000000140000000-0x0000000140862000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/4716-4215-0x0000000140000000-0x0000000140862000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/4716-4753-0x0000000140000000-0x0000000140862000-memory.dmp

                                Filesize

                                8.4MB

                                Download

                              • memory/5256-4729-0x000002CD788E0000-0x000002CD78992000-memory.dmp

                                Filesize

                                712KB

                                Download

                              • memory/5256-4739-0x000002CD7DA20000-0x000002CD7DA58000-memory.dmp

                                Filesize

                                224KB

                                Download

                              • memory/5256-4751-0x000002CD7DDE0000-0x000002CD7DDFE000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/5256-4747-0x000002CD7DD30000-0x000002CD7DD3C000-memory.dmp

                                Filesize

                                48KB

                                Download

                              • memory/5256-4744-0x000002CD7E2F0000-0x000002CD7E816000-memory.dmp

                                Filesize

                                5.1MB

                                Download

                              • memory/5256-4741-0x000002CD7DD20000-0x000002CD7DD2A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/5256-4743-0x000002CD7DDA0000-0x000002CD7DDC2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/5256-4742-0x000002CD7DD40000-0x000002CD7DDA2000-memory.dmp

                                Filesize

                                392KB

                                Download

                              • memory/5256-4740-0x000002CD7CBF0000-0x000002CD7CBF8000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/5256-4738-0x000002CD7CB90000-0x000002CD7CB98000-memory.dmp

                                Filesize

                                32KB

                                Download

                              • memory/5256-4736-0x000002CD78A60000-0x000002CD78D60000-memory.dmp

                                Filesize

                                3.0MB

                                Download

                              • memory/5256-4732-0x000002CD5E170000-0x000002CD5E17A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/5256-4731-0x000002CD789E0000-0x000002CD78A30000-memory.dmp

                                Filesize

                                320KB

                                Download

                              • memory/5256-4727-0x000002CD78880000-0x000002CD7888A000-memory.dmp

                                Filesize

                                40KB

                                Download

                              • memory/5256-4728-0x000002CD788A0000-0x000002CD788CA000-memory.dmp

                                Filesize

                                168KB

                                Download

                              • memory/5256-4726-0x000002CD78730000-0x000002CD78754000-memory.dmp

                                Filesize

                                144KB

                                Download

                              • memory/5256-4718-0x000002CD5E190000-0x000002CD5E1A0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/5256-4724-0x000002CD5E1A0000-0x000002CD5E1B4000-memory.dmp

                                Filesize

                                80KB

                                Download

                              • memory/5256-4719-0x000002CD5E350000-0x000002CD5E35C000-memory.dmp

                                Filesize

                                48KB

                                Download

                              • memory/5256-4717-0x000002CD78520000-0x000002CD7862A000-memory.dmp

                                Filesize

                                1.0MB

                                Download

                              • memory/5256-4708-0x000002CD5A550000-0x000002CD5DD84000-memory.dmp

                                Filesize

                                56.2MB

                                Download

                              • memory/5276-4493-0x000000006E1F0000-0x000000006E540000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/5276-4498-0x0000000009940000-0x00000000099E5000-memory.dmp

                                Filesize

                                660KB

                                Download

                              • memory/5276-4492-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/5388-3052-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/5388-3053-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/5568-3306-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/5568-3305-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/5696-2980-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5696-1663-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5696-2259-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5696-3815-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5740-3951-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5740-3217-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5740-1664-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5740-2260-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5832-2978-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5832-2257-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5832-1661-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5832-3950-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5860-4243-0x000000006E1F0000-0x000000006E540000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/5860-4242-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/5884-3961-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5884-2979-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5884-1662-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5884-2258-0x0000000000400000-0x0000000001DF3000-memory.dmp

                                Filesize

                                25.9MB

                                Download

                              • memory/5904-2981-0x0000000000400000-0x00000000008AD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5904-4444-0x0000000000400000-0x00000000008AD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5904-4571-0x0000000000400000-0x00000000008AD000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/6020-3061-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/6020-3060-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/6024-1374-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/6024-1375-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/6052-1354-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/6052-1363-0x0000000009680000-0x0000000009725000-memory.dmp

                                Filesize

                                660KB

                                Download

                              • memory/6052-1282-0x0000000007D30000-0x0000000008080000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/6052-1358-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/6068-1368-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/6068-1369-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download

                              • memory/6072-1353-0x000000006F8E0000-0x000000006F92B000-memory.dmp

                                Filesize

                                300KB

                                Download

                              • memory/6072-1355-0x000000006F3B0000-0x000000006F700000-memory.dmp

                                Filesize

                                3.3MB

                                Download