Overview

overview

10

Static

static

1

0fe604088f...d3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-05-2024 15:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0fe604088fc3cb6f07ba074b4100627239bd38456f256a9083f2e8e12dd82ad3.exe

  • Size

    409KB

  • MD5

    edcd9de4254f050ffa56e723be49c0c5

  • SHA1

    054c541726383f1d70572f72a83ad86061141d64

  • SHA256

    0fe604088fc3cb6f07ba074b4100627239bd38456f256a9083f2e8e12dd82ad3

  • SHA512

    aadf2f8fd82146c1174efe01261871caff89ba0ca3b18c6be77472609b8dbfa8b4c2b9d15968a7d423be9af0c79005311663478bd6d79fbcb87cf42a5bd20328

  • SSDEEP

    12288:AiwMdowCeYkiyh9bGfD7NUwW1ROABchrj9j48Re9TY:AiwQowukiS4iwGROuqrj91

Score
10/10
gluptebastealczgratdiscoverydropperevasionexecutionloaderpersistenceratrootkitstealertrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 24 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 15 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 16 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 10 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fe604088fc3cb6f07ba074b4100627239bd38456f256a9083f2e8e12dd82ad3.exe
    "C:\Users\Admin\AppData\Local\Temp\0fe604088fc3cb6f07ba074b4100627239bd38456f256a9083f2e8e12dd82ad3.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Checks computer location settings
    • Windows security modification
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\0fe604088fc3cb6f07ba074b4100627239bd38456f256a9083f2e8e12dd82ad3.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2548
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Users\Admin\Pictures\88qVA71GFy1Nq4onm1oSpddh.exe
        "C:\Users\Admin\Pictures\88qVA71GFy1Nq4onm1oSpddh.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3852
        • C:\Users\Admin\AppData\Local\Temp\u2z0.0.exe
          "C:\Users\Admin\AppData\Local\Temp\u2z0.0.exe"
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:3116
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 1272
            5⤵
            • Program crash
            PID:4440
        • C:\Users\Admin\AppData\Local\Temp\u2z0.1.exe
          "C:\Users\Admin\AppData\Local\Temp\u2z0.1.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3696
          • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
            "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 1516
          4⤵
          • Program crash
          PID:2944
      • C:\Users\Admin\Pictures\mROzCSDwjdNgpJpwGjxU8PZ6.exe
        "C:\Users\Admin\Pictures\mROzCSDwjdNgpJpwGjxU8PZ6.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3764
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1644
        • C:\Users\Admin\Pictures\mROzCSDwjdNgpJpwGjxU8PZ6.exe
          "C:\Users\Admin\Pictures\mROzCSDwjdNgpJpwGjxU8PZ6.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2588
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
              PID:528
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:928
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:1912
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious use of AdjustPrivilegeToken
              PID:2032
        • C:\Users\Admin\Pictures\HkNR03C8eGLoJYmYsDiS3idD.exe
          "C:\Users\Admin\Pictures\HkNR03C8eGLoJYmYsDiS3idD.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4368
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4852
          • C:\Users\Admin\Pictures\HkNR03C8eGLoJYmYsDiS3idD.exe
            "C:\Users\Admin\Pictures\HkNR03C8eGLoJYmYsDiS3idD.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1372
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1600
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
                PID:3328
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  PID:668
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:4348
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Suspicious use of AdjustPrivilegeToken
                PID:2412
          • C:\Users\Admin\Pictures\gkCrJzLv4Tcf2A3uZl1bCPwG.exe
            "C:\Users\Admin\Pictures\gkCrJzLv4Tcf2A3uZl1bCPwG.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1732
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3680
            • C:\Users\Admin\Pictures\gkCrJzLv4Tcf2A3uZl1bCPwG.exe
              "C:\Users\Admin\Pictures\gkCrJzLv4Tcf2A3uZl1bCPwG.exe"
              4⤵
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Adds Run key to start application
              • Checks for VirtualBox DLLs, possible anti-VM trick
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1956
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1668
              • C:\Windows\system32\cmd.exe
                C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                5⤵
                  PID:2944
                  • C:\Windows\system32\netsh.exe
                    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                    6⤵
                    • Modifies Windows Firewall
                    PID:3560
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3368
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Drops file in System32 directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5032
                • C:\Windows\rss\csrss.exe
                  C:\Windows\rss\csrss.exe
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Manipulates WinMonFS driver.
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4724
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    6⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3440
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                    6⤵
                    • Creates scheduled task(s)
                    PID:3640
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /delete /tn ScheduledUpdate /f
                    6⤵
                      PID:5008
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3732
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4752
                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                      6⤵
                      • Executes dropped EXE
                      PID:808
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      6⤵
                      • Creates scheduled task(s)
                      PID:1568
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      6⤵
                      • Executes dropped EXE
                      PID:4404
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        7⤵
                          PID:4524
                          • C:\Windows\SysWOW64\sc.exe
                            sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                            8⤵
                            • Launches sc.exe
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3908
                • C:\Users\Admin\Pictures\Mkb433YgG0jW3gAvc3R5VDpF.exe
                  "C:\Users\Admin\Pictures\Mkb433YgG0jW3gAvc3R5VDpF.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4156
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2420
                  • C:\Users\Admin\Pictures\Mkb433YgG0jW3gAvc3R5VDpF.exe
                    "C:\Users\Admin\Pictures\Mkb433YgG0jW3gAvc3R5VDpF.exe"
                    4⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Checks for VirtualBox DLLs, possible anti-VM trick
                    • Drops file in Windows directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:64
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Drops file in System32 directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1088
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                      5⤵
                        PID:1744
                        • C:\Windows\system32\netsh.exe
                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                          6⤵
                          • Modifies Windows Firewall
                          PID:3324
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2028
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4692
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
                  2⤵
                    PID:3980
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3852 -ip 3852
                  1⤵
                    PID:1760
                  • C:\Windows\windefender.exe
                    C:\Windows\windefender.exe
                    1⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    PID:3300
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3116 -ip 3116
                    1⤵
                      PID:2044

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Privilege Escalation

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Defense Evasion

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Impair Defenses

                    4
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Disable or Modify Tools

                    3
                    T1562.001

                    Modify Registry

                    5
                    T1112

                    Credential Access

                    Discovery

                    Peripheral Device Discovery

                    1
                    T1120

                    Query Registry

                    5
                    T1012

                    System Information Discovery

                    6
                    T1082

                    Lateral Movement

                    Collection

                    Command and Control

                    Web Service

                    1
                    T1102

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      21KB

                      MD5

                      2c3c5110dba295f6a43399d0c0f3bcf6

                      SHA1

                      5808d6e05444d9ba2161bb86e62747e1bce10662

                      SHA256

                      d69c3f881824d37a1d50313cffb81b00845a799fc38e1da8e189eacd4124c54d

                      SHA512

                      4f8888252b5b006b05065aaa82e17fbc9947667b17245973799269ad9edc09272ccf2ec4b001231aaaf5c131009b81c8195ec42cff0975288c4002381d21afa3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      664B

                      MD5

                      0a560bd6e4ef1d819e190e3b221c3c45

                      SHA1

                      b90544e2f23205e58f7c0f10b060c0845d575d45

                      SHA256

                      d3f876482907f9f1637ce26b1a05639171105d5e204823c7af3fccb23e0252aa

                      SHA512

                      12668d6c505b159907a6e53e75e9bc5b4fd53afb2cf359b8e2be0d2f098bcbf061c6272ec93552194df8c5766906077ef57e4be04a399786a0ce7db23708a9f9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      21KB

                      MD5

                      467921b8dfdea995764be4db0e929f10

                      SHA1

                      3478bfd842f9a18bba096ea5835d9d24bc36b131

                      SHA256

                      1a74e2cb15498ec88c4518ba8a8352019bb69fc855c4211178b23880deeef494

                      SHA512

                      5d27124b6c753483501cfed3f41c22b57c3f1a3e0da98dcd72c5ab719a8dc2b87be556d66a07e6f3678235f318b4bdece9baf7aa5037c278c3ca941c2adb59ad

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ps31x2pn.zno.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                      Filesize

                      281KB

                      MD5

                      d98e33b66343e7c96158444127a117f6

                      SHA1

                      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                      SHA256

                      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                      SHA512

                      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                      Filesize

                      2KB

                      MD5

                      45029627d064f6f7a3e2584118ed7563

                      SHA1

                      f42993a8ac5fb932a7c7c42c7bd655f3054cffbc

                      SHA256

                      699308affe36089532cfa1b08ab450772afae397a4eb3c5bd7564ecfa2c62f16

                      SHA512

                      95899f1df7fe01bb763349d44e615b2b0363a5097c16b7d7196207045fd4261386b49fe8acde81a9cff9c5b0f199538387d6cb83b9c2cad0fcda05853ca47d24

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                      Filesize

                      3KB

                      MD5

                      df6c931876d0256be99bfa456e322695

                      SHA1

                      fd5f0557d9789d862929f69e17ee2af81771cdda

                      SHA256

                      a8970ca480b6431643a4e8627d2a9969a2325574624c441b28fb35546cfc92ef

                      SHA512

                      89c79fbc9efdfcfc697af4209a7cef5193f8c0be6186b48f839eb3a7df7ed445984e8de2b8581b63ef491713b568dc3f144b59caa090b0daa81619009bf5708f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\u2z0.0.exe
                      Filesize

                      226KB

                      MD5

                      c4b38f17b16a0b545d989a5e7f192308

                      SHA1

                      7325ba75f76855f332e840d595cadc591ea220af

                      SHA256

                      45072f942cb27587d1815a9c079c066c85ac313fe1388fd61dd69c77bdc68b4b

                      SHA512

                      ca30aa925c6bec667fa4aceda9918d9e7c1ddee1fb7eded4ee266f6f6ae2d3e2fea7070049dc28540615832fc2e60e2821aabc839f468d446b44e082558ef041

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\u2z0.1.exe
                      Filesize

                      4.6MB

                      MD5

                      397926927bca55be4a77839b1c44de6e

                      SHA1

                      e10f3434ef3021c399dbba047832f02b3c898dbd

                      SHA256

                      4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

                      SHA512

                      cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

                      Download Submit

                    • C:\Users\Admin\Pictures\88qVA71GFy1Nq4onm1oSpddh.exe
                      Filesize

                      368KB

                      MD5

                      5af092dba0ea0929354397630215b41a

                      SHA1

                      fd605744f6d4f629e22e7a2fb370c8da4dc21d83

                      SHA256

                      9abf357befc1310b1960a5a976866438d916ab066aeb15cc43a9713b29bf300e

                      SHA512

                      5e16cae0240a1de45bc474c53bb00ca720fb030c66dac7e74c762e137e5b2361f9e0a89399d39b4b0d9b38b3bb18a49fc10176ec1afe1c54bc1c5d5583e01ab9

                      Download Submit

                    • C:\Users\Admin\Pictures\gkCrJzLv4Tcf2A3uZl1bCPwG.exe
                      Filesize

                      4.1MB

                      MD5

                      d55b5ef96c5ec431ddb9baeac60272f4

                      SHA1

                      e1744f8a4b1433746d91972388f2af6b26fa841d

                      SHA256

                      ada79f56b84a94f7870b9ac7c425494358863e30609bd18baf0229d3e55388da

                      SHA512

                      8b3b57fc9a22476ddfcce95aed99ebda03a7021c306daa6fdad898e56fe8bb6c4932d46a0e53deaea0e807552b3598b27a69bc359bd907bd75bfd1575bfa565d

                      Download Submit

                    • C:\Users\Admin\Pictures\mROzCSDwjdNgpJpwGjxU8PZ6.exe
                      Filesize

                      4.1MB

                      MD5

                      f6a39cd537cec35ae05b5615702c0125

                      SHA1

                      3b8bf4e10848eb7a05d9c85c588af194bb02df4c

                      SHA256

                      36d0a6d463a523e3644575a513c96ed6833b87d1c4efc579d89b2261b226f7b6

                      SHA512

                      59e3148b1fe69e657708eac51db39a8b50b12e52190d792a0ea691c174c46ef85908bc62d9f0a20d1bdaf017d98de07643c755816bd9f294257ab9a3cc45443b

                      Download Submit

                    • C:\Users\Admin\Pictures\tshBQKwOU47h9VUIaKCt4WHi.exe
                      Filesize

                      7KB

                      MD5

                      77f762f953163d7639dff697104e1470

                      SHA1

                      ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

                      SHA256

                      d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

                      SHA512

                      d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      3d086a433708053f9bf9523e1d87a4e8

                      SHA1

                      b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                      SHA256

                      6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                      SHA512

                      931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      d89ec8e3842a5bb783cd609bd6e31609

                      SHA1

                      4b30d36f4dfdd73e0ad6ef93e9d4c26981ae43d5

                      SHA256

                      156bbb4c65977dcfd2c1867d3468d8938b3c994b1be4b244fa435c96bcbbfc15

                      SHA512

                      27e91c03b60a5827a906d6573647df5b27919038f72c95352105f8dfdc93c615eec67175353078112ead9bc8a742fd1a5b514cb3262d55e597a8a9da96f550af

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      0ea9ce67c3eb523620a08b7ed50b2f73

                      SHA1

                      304385c0efae289bdef3feab51f0ebb72078b603

                      SHA256

                      015bc7ea417534a671e761bf8e5b4d07ca8423278fea5ae8da6184373c7cb479

                      SHA512

                      2f300f496cbe799cec9145dba66c017784cd07dfcde14b1ce45fdf597cde5b308f7ffcfbe14af98ace562bb13b9b6a66cbed1ba21857188bc8b4877d0787598d

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      2ba5b7220c90bdeed1a51401a6590427

                      SHA1

                      abaa09852a300a328244a92c8ecc071a7da4dac5

                      SHA256

                      cfe6fd1676e686a469f4e21396f79e28a6ac2988aee204e49f59dc77150b9e36

                      SHA512

                      063741841c02c2a3327fef7e46a3973ad9bc32ce772f60e8a883449af712e4042d286eb53b79608b0d53eecd84532353f98156839f5a4d9bef2bc9de34d90c41

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      8b1d907024e1f190b9d9d8c249af6325

                      SHA1

                      385fefaeb29cfb3a3422c228e03c922cd426bf81

                      SHA256

                      5e26333b162d53c5760bc5627db7540e14e29c0499e2b25c917edc2d9c7b50b1

                      SHA512

                      ca86a04c1f922e85afd0f2ffbcd711fd2871532bb292a3d477e5012820c46287c6dc434f65db52c2ae8d3716e803b83ffb6b280f13e9a7b74b152aef997ff590

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      6fc89ca01a228bbbc5f485cb2b3975e8

                      SHA1

                      89e190812a95d582ad6f9ab889118a4b942eb9ae

                      SHA256

                      e5655438d9cbe73ec5f566220b5e8126bcc5f4d53a93b0af3088b94882376dd3

                      SHA512

                      c087b3d3a11c0f37bbe7639bcc8ae00ff62e612d8b1bc6973f18afa00a0933f1455d3b884d518bfb9c2dc0498c8762b43a456de53204186e5ea1d1606cfa24d4

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      c37d3603a3c3424a1ba35ccd33639de2

                      SHA1

                      f3bd2aadcb84fa30cd8b780f7e1735fa01d93473

                      SHA256

                      fe13a5eeec7cbc2de623e0c44c9cceee4b06a62ddc21dd94309c57974b6af0e5

                      SHA512

                      ae4e82c487f9285c22b446c4370aa65c4a50ecd62477c59c219e9832afc6fdbe6135f7534ee592a2c2f7ee7658efe26dddca6e85a289e37721d2ee03aba4e189

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      e5390d219923194bba0842c0da667c60

                      SHA1

                      6342dfe8a7cfa521cdd2df22156a7ebf4825307c

                      SHA256

                      5a3aafa8ec73b001958fe8322b4a5937c8b91daaf7fc7ac394ff9695f3e0a5d7

                      SHA512

                      db144ce371fe614a0b1c10c6a19228fc20e7f2330661358830f76b09286cea32816e4f446b8ec20050a880913830950fa75e950a57e396a84c2165e1457c1eb7

                      Download Submit

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                      Filesize

                      19KB

                      MD5

                      d386a3422a037d3082b2fc2d151a384f

                      SHA1

                      8506ab4855b241a804498e26854ffee87ed8ab95

                      SHA256

                      ce2b0b15d94df18b4b23c026a6f8269c1dc2459df395a6de0cad19b0a82ab189

                      SHA512

                      3a5eedf9a72a5326c468d42744e9764283e44f2b348b7a7cd733ba63ff1dc9a667f44c54ba364e926cf46785ef869c6dc72047d1f47c86bc0b58b762e6eaeda4

                      Download Submit

                    • C:\Windows\windefender.exe
                      Filesize

                      2.0MB

                      MD5

                      8e67f58837092385dcf01e8a2b4f5783

                      SHA1

                      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                      SHA256

                      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                      SHA512

                      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                      Download Submit

                    • memory/64-591-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/64-468-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/64-347-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/64-604-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1088-293-0x000000006EEC0000-0x000000006F214000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/1088-303-0x00000000073A0000-0x0000000007443000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/1088-292-0x000000006F680000-0x000000006F6CC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1088-291-0x00000000062A0000-0x00000000062EC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1088-268-0x0000000005B80000-0x0000000005ED4000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/1372-606-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1372-345-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1372-466-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1372-589-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1600-337-0x00000000070C0000-0x00000000070D1000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/1600-305-0x000000006EEC0000-0x000000006F214000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/1600-304-0x000000006F680000-0x000000006F6CC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1644-191-0x000000006F140000-0x000000006F494000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/1644-216-0x0000000007240000-0x0000000007254000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/1644-163-0x0000000007520000-0x0000000007B9A000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/1644-162-0x0000000006E20000-0x0000000006E96000-memory.dmp

                      Filesize

                      472KB

                      Download

                    • memory/1644-188-0x00000000701D0000-0x000000007021C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1668-315-0x000000006F680000-0x000000006F6CC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1668-316-0x000000006EEC0000-0x000000006F214000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/1668-338-0x0000000007F20000-0x0000000007F34000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/1732-233-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1912-460-0x0000000006580000-0x0000000006594000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/1912-427-0x000000006F730000-0x000000006FA84000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/1912-426-0x000000006F6E0000-0x000000006F72C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/1956-603-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1956-344-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1956-465-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1956-588-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/1964-12-0x0000000074F6E000-0x0000000074F6F000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/1964-5-0x0000000000400000-0x0000000000408000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/2028-450-0x000000006F730000-0x000000006FA84000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/2028-449-0x000000006F6E0000-0x000000006F72C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2032-539-0x0000000070160000-0x00000000701AC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2032-553-0x000000006F7B0000-0x000000006FB04000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/2112-22-0x00007FFA948E0000-0x00007FFA953A1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/2112-1-0x00007FFA948E3000-0x00007FFA948E5000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2112-0-0x00000205AA780000-0x00000205AA790000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2112-2-0x00000205AC440000-0x00000205AC450000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2112-4-0x00007FFA948E0000-0x00007FFA953A1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/2112-3-0x00000205AC4B0000-0x00000205AC50C000-memory.dmp

                      Filesize

                      368KB

                      Download

                    • memory/2420-217-0x0000000007A60000-0x0000000007A7A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/2420-155-0x00000000067A0000-0x00000000067EC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2420-161-0x00000000065D0000-0x0000000006614000-memory.dmp

                      Filesize

                      272KB

                      Download

                    • memory/2420-201-0x0000000007900000-0x000000000790A000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/2420-167-0x00000000701D0000-0x000000007021C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2420-110-0x0000000005470000-0x0000000005492000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/2420-178-0x000000006F140000-0x000000006F494000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/2420-214-0x0000000007920000-0x0000000007931000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/2420-190-0x0000000007810000-0x00000000078B3000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/2420-154-0x0000000006240000-0x000000000625E000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/2548-14-0x00000210E0310000-0x00000210E0320000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2548-7-0x00007FFA948E0000-0x00007FFA953A1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/2548-13-0x00000210E0310000-0x00000210E0320000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2548-21-0x00007FFA948E0000-0x00007FFA953A1000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/2548-19-0x00000210E1CA0000-0x00000210E1CC2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/2588-327-0x000000006EEC0000-0x000000006F214000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/2588-326-0x000000006F680000-0x000000006F6CC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/2752-467-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/2752-590-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/2752-605-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/2752-346-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/3116-698-0x0000000000400000-0x0000000001A03000-memory.dmp

                      Filesize

                      22.0MB

                      Download

                    • memory/3116-718-0x0000000000400000-0x0000000001A03000-memory.dmp

                      Filesize

                      22.0MB

                      Download

                    • memory/3116-635-0x0000000000400000-0x0000000001A03000-memory.dmp

                      Filesize

                      22.0MB

                      Download

                    • memory/3116-464-0x0000000000400000-0x0000000001A03000-memory.dmp

                      Filesize

                      22.0MB

                      Download

                    • memory/3116-234-0x0000000000400000-0x0000000001A03000-memory.dmp

                      Filesize

                      22.0MB

                      Download

                    • memory/3300-713-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                      Download

                    • memory/3368-425-0x0000000007090000-0x0000000007133000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/3368-379-0x0000000005A90000-0x0000000005DE4000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/3368-413-0x00000000063E0000-0x000000000642C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/3368-448-0x00000000057A0000-0x00000000057B1000-memory.dmp

                      Filesize

                      68KB

                      Download

                    • memory/3368-415-0x000000006F730000-0x000000006FA84000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/3368-414-0x000000006F6E0000-0x000000006F72C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/3672-565-0x0000021A780F0000-0x0000021A78112000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/3672-552-0x0000021A76EF0000-0x0000021A76EF8000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/3672-550-0x0000021A76F00000-0x0000021A76F38000-memory.dmp

                      Filesize

                      224KB

                      Download

                    • memory/3672-551-0x0000021A76ED0000-0x0000021A76EDE000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/3672-369-0x0000021A6B8D0000-0x0000021A6F104000-memory.dmp

                      Filesize

                      56.2MB

                      Download

                    • memory/3672-409-0x0000021A70FA0000-0x0000021A70FB0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3672-563-0x0000021A77DE0000-0x0000021A77DEA000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/3672-412-0x0000021A717F0000-0x0000021A71814000-memory.dmp

                      Filesize

                      144KB

                      Download

                    • memory/3672-411-0x0000021A70FB0000-0x0000021A70FC4000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/3672-408-0x0000021A72830000-0x0000021A7293A000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/3672-564-0x0000021A78090000-0x0000021A780F2000-memory.dmp

                      Filesize

                      392KB

                      Download

                    • memory/3672-515-0x0000021A70E80000-0x0000021A70E8A000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/3672-518-0x0000021A72B30000-0x0000021A72B80000-memory.dmp

                      Filesize

                      320KB

                      Download

                    • memory/3672-517-0x0000021A71830000-0x0000021A7185A000-memory.dmp

                      Filesize

                      168KB

                      Download

                    • memory/3672-516-0x0000021A72A80000-0x0000021A72B32000-memory.dmp

                      Filesize

                      712KB

                      Download

                    • memory/3672-519-0x0000021A70E90000-0x0000021A70E9A000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/3672-523-0x0000021A72B80000-0x0000021A72E80000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/3672-538-0x0000021A775C0000-0x0000021A775C8000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/3672-410-0x0000021A70FC0000-0x0000021A70FCC000-memory.dmp

                      Filesize

                      48KB

                      Download

                    • memory/3680-202-0x00000000701D0000-0x000000007021C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/3680-203-0x000000006F140000-0x000000006F494000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/3680-218-0x0000000007300000-0x0000000007308000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/3680-129-0x0000000005720000-0x0000000005A74000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/3680-111-0x0000000004D60000-0x0000000004DC6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3680-112-0x0000000004DD0000-0x0000000004E36000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/3696-368-0x0000000000400000-0x00000000008AD000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/3696-343-0x0000000000400000-0x00000000008AD000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/3764-231-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/3852-160-0x0000000000400000-0x0000000001A26000-memory.dmp

                      Filesize

                      22.1MB

                      Download

                    • memory/4156-230-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/4348-437-0x000000006F6E0000-0x000000006F72C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4348-438-0x000000006F730000-0x000000006FA84000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/4368-232-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/4692-540-0x000000006F7B0000-0x000000006FB04000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/4692-537-0x0000000070160000-0x00000000701AC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4724-697-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/4724-709-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/4724-715-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/4724-636-0x0000000000400000-0x0000000001DE6000-memory.dmp

                      Filesize

                      25.9MB

                      Download

                    • memory/4852-98-0x0000000002240000-0x0000000002276000-memory.dmp

                      Filesize

                      216KB

                      Download

                    • memory/4852-166-0x00000000701D0000-0x000000007021C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4852-184-0x0000000007130000-0x000000000714E000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/4852-168-0x000000006F140000-0x000000006F494000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/4852-165-0x00000000070F0000-0x0000000007122000-memory.dmp

                      Filesize

                      200KB

                      Download

                    • memory/4852-164-0x0000000006F30000-0x0000000006F4A000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/4852-215-0x00000000072A0000-0x00000000072AE000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/4852-100-0x0000000004F40000-0x0000000005568000-memory.dmp

                      Filesize

                      6.2MB

                      Download

                    • memory/4852-213-0x0000000007300000-0x0000000007396000-memory.dmp

                      Filesize

                      600KB

                      Download

                    • memory/5032-476-0x0000000005DF0000-0x0000000006144000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/5032-525-0x0000000070160000-0x00000000701AC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/5032-536-0x00000000076B0000-0x0000000007753000-memory.dmp

                      Filesize

                      652KB

                      Download

                    • memory/5032-526-0x000000006F7B0000-0x000000006FB04000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/5032-505-0x00000000064B0000-0x00000000064FC000-memory.dmp

                      Filesize

                      304KB

                      Download