Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8eec6abf18...cs.exe

windows7-x64

10

8eec6abf18...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 16:35 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe

  • Size

    404KB

  • MD5

    8eec6abf18ef5e6ce025c75d03744600

  • SHA1

    c2c5ea03a9a2c024c4713df18c24dc517254d5f6

  • SHA256

    f8645e4d70d72dcd44a1606437c8481d415f9791b89dda79e5d7dfd0056a3357

  • SHA512

    3bc5ac244f1e63a2e45b330feb988e58f3827252f35164c82938e40d1c43f1323852758a0294c04a14db173177fe5a9fb8968851b8b8f9503422393e68e168a2

  • SSDEEP

    6144:zFnmGM8FncD84WsYk8WPdFZ+V3zu4NfCWXmCL/AvBFIUHf/:z5mLrD8xgzJu3zu4Nf5XmiUOw/

Score
10/10
stealczgratdiscoveryratstealer

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2624
    • C:\Users\Admin\AppData\Local\Temp\u20w.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u20w.0.exe"
      2⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 1332
        3⤵
        • Program crash
        PID:4656
    • C:\Users\Admin\AppData\Local\Temp\u20w.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u20w.1.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2272
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 428
      2⤵
      • Program crash
      PID:2332
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2624 -ip 2624
    1⤵
      PID:4496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2576 -ip 2576
      1⤵
        PID:4488

      Network

      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZWKfFfByGQ0aAhVYxMQcLTVUCUx6bLkZJpRHf4Gjx1DlEQKqyhCqn3XiMVt_OWzDRX6owgN_UDBSDWx8AuGnryPTyQ6Kjjw_WsnZRdPopomhPWyN9lL6gNuH2p5eBDGn7uzaGFESZAd61OULW6vfunUS3TDg1vP45vDoC8FlspZNGg3D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D5ff24b92b12a15f5ee1c2da9d19fef97&TIME=20240508T112435Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZWKfFfByGQ0aAhVYxMQcLTVUCUx6bLkZJpRHf4Gjx1DlEQKqyhCqn3XiMVt_OWzDRX6owgN_UDBSDWx8AuGnryPTyQ6Kjjw_WsnZRdPopomhPWyN9lL6gNuH2p5eBDGn7uzaGFESZAd61OULW6vfunUS3TDg1vP45vDoC8FlspZNGg3D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D5ff24b92b12a15f5ee1c2da9d19fef97&TIME=20240508T112435Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=05ED4C3B2B2F6A31029858412ACF6B6B; domain=.bing.com; expires=Tue, 03-Jun-2025 16:35:28 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 184741E4730C4724A5FB52FAC9D7FF4E Ref B: LON04EDGE1111 Ref C: 2024-05-09T16:35:28Z
        date: Thu, 09 May 2024 16:35:27 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZWKfFfByGQ0aAhVYxMQcLTVUCUx6bLkZJpRHf4Gjx1DlEQKqyhCqn3XiMVt_OWzDRX6owgN_UDBSDWx8AuGnryPTyQ6Kjjw_WsnZRdPopomhPWyN9lL6gNuH2p5eBDGn7uzaGFESZAd61OULW6vfunUS3TDg1vP45vDoC8FlspZNGg3D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D5ff24b92b12a15f5ee1c2da9d19fef97&TIME=20240508T112435Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZWKfFfByGQ0aAhVYxMQcLTVUCUx6bLkZJpRHf4Gjx1DlEQKqyhCqn3XiMVt_OWzDRX6owgN_UDBSDWx8AuGnryPTyQ6Kjjw_WsnZRdPopomhPWyN9lL6gNuH2p5eBDGn7uzaGFESZAd61OULW6vfunUS3TDg1vP45vDoC8FlspZNGg3D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D5ff24b92b12a15f5ee1c2da9d19fef97&TIME=20240508T112435Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=05ED4C3B2B2F6A31029858412ACF6B6B; _EDGE_S=SID=00530285595663013CD316FF58FA62E4
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=i6dhtNtGf7HUqpM1cqaaQkVY12gqtDSbTtbxw_t9YmU; domain=.bing.com; expires=Tue, 03-Jun-2025 16:35:28 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 15368401F7ED464FBE19B5A3D49C38A4 Ref B: LON04EDGE1111 Ref C: 2024-05-09T16:35:28Z
        date: Thu, 09 May 2024 16:35:28 GMT
      • flag-be
        GET
        https://www.bing.com/aes/c.gif?RG=5a6d7e1f932b47c1875f2a9cc12447b4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112435Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981
        Remote address:
        2.17.196.91:443
        Request
        GET /aes/c.gif?RG=5a6d7e1f932b47c1875f2a9cc12447b4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112435Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981 HTTP/2.0
        host: www.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=05ED4C3B2B2F6A31029858412ACF6B6B
        Response
        HTTP/2.0 200
        cache-control: private,no-store
        pragma: no-cache
        vary: Origin
        p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 4C53F3C475C146EA960675F8703B47E6 Ref B: FRA31EDGE0705 Ref C: 2024-05-09T16:35:28Z
        content-length: 0
        date: Thu, 09 May 2024 16:35:28 GMT
        set-cookie: _EDGE_S=SID=00530285595663013CD316FF58FA62E4; path=/; httponly; domain=bing.com
        set-cookie: MUIDB=05ED4C3B2B2F6A31029858412ACF6B6B; path=/; httponly; expires=Tue, 03-Jun-2025 16:35:28 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.57c41102.1715272528.3033e0e7
      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        237.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.197.79.204.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        140.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        140.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        77.190.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        77.190.18.2.in-addr.arpa
        IN PTR
        Response
        77.190.18.2.in-addr.arpa
        IN PTR
        a2-18-190-77deploystaticakamaitechnologiescom
      • flag-us
        DNS
        91.196.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.196.17.2.in-addr.arpa
        IN PTR
        Response
        91.196.17.2.in-addr.arpa
        IN PTR
        a2-17-196-91deploystaticakamaitechnologiescom
      • flag-be
        GET
        https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        Remote address:
        2.17.196.91:443
        Request
        GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
        host: www.bing.com
        accept: */*
        cookie: MUID=05ED4C3B2B2F6A31029858412ACF6B6B; _EDGE_S=SID=00530285595663013CD316FF58FA62E4; MSPTC=i6dhtNtGf7HUqpM1cqaaQkVY12gqtDSbTtbxw_t9YmU; MUIDB=05ED4C3B2B2F6A31029858412ACF6B6B
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-type: image/png
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        content-length: 1107
        date: Thu, 09 May 2024 16:35:29 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.57c41102.1715272529.3033e639
      • flag-us
        DNS
        55.36.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        55.36.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-de
        GET
        http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
        8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
        Remote address:
        185.172.128.90:80
        Request
        GET /cpa/ping.php?substr=two&s=ab&sub=0 HTTP/1.1
        Host: 185.172.128.90
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Thu, 09 May 2024 16:35:35 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 1
        Content-Type: text/html; charset=UTF-8
      • flag-us
        DNS
        90.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        90.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-de
        GET
        http://185.172.128.228/ping.php?substr=two
        8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /ping.php?substr=two HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Thu, 09 May 2024 16:35:36 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.59/syncUpd.exe
        8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
        Remote address:
        185.172.128.59:80
        Request
        GET /syncUpd.exe HTTP/1.1
        Host: 185.172.128.59
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Thu, 09 May 2024 16:35:36 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Thu, 09 May 2024 16:30:01 GMT
        ETag: "36600-61807ee48cbe8"
        Accept-Ranges: bytes
        Content-Length: 222720
        Content-Type: application/x-msdos-program
      • flag-us
        DNS
        228.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        59.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-de
        GET
        http://185.172.128.228/BroomSetup.exe
        8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /BroomSetup.exe HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Thu, 09 May 2024 16:35:37 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Fri, 15 Mar 2024 11:59:56 GMT
        ETag: "4a4030-613b1bf118700"
        Accept-Ranges: bytes
        Content-Length: 4866096
        Content-Type: application/x-msdos-program
      • flag-us
        DNS
        svc.iolo.com
        u20w.1.exe
        Remote address:
        8.8.8.8:53
        Request
        svc.iolo.com
        IN A
        Response
        svc.iolo.com
        IN A
        20.157.87.45
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        u20w.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 256
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb9
        date: Thu, 09 May 2024 16:35:41 GMT
        set-cookie: SERVERID=svc9; path=/
        connection: close
      • flag-us
        DNS
        45.87.157.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        45.87.157.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        download.iolo.net
        Remote address:
        8.8.8.8:53
        Request
        download.iolo.net
        IN A
        Response
        download.iolo.net
        IN CNAME
        iolo0.b-cdn.net
        iolo0.b-cdn.net
        IN A
        185.93.2.244
      • flag-fr
        HEAD
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        Remote address:
        185.93.2.244:443
        Request
        HEAD /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe HTTP/2.0
        host: download.iolo.net
        accept: */*
        accept-encoding: identity
        user-agent: Microsoft BITS/7.8
        Response
        HTTP/2.0 200
        date: Thu, 09 May 2024 16:35:47 GMT
        content-type: application/octet-stream
        content-length: 58919336
        server: BunnyCDN-FR1-951
        cdn-pullzone: 1654350
        cdn-uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028
        cdn-requestcountrycode: GB
        cache-control: public, max-age=259200
        last-modified: Mon, 29 Apr 2024 18:38:19 GMT
        cdn-storageserver: DE-664
        cdn-fileserver: 594
        cdn-proxyver: 1.04
        cdn-requestpullsuccess: True
        cdn-requestpullcode: 206
        cdn-cachedat: 05/06/2024 22:02:11
        cdn-edgestorageid: 1187
        cdn-status: 200
        cdn-requestid: c465ce7521032b6f076af33c4baca73b
        cdn-cache: HIT
        accept-ranges: bytes
      • flag-fr
        GET
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        Remote address:
        185.93.2.244:443
        Request
        GET /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe HTTP/2.0
        host: download.iolo.net
        accept: */*
        accept-encoding: identity
        if-unmodified-since: Mon, 29 Apr 2024 18:38:19 GMT
        user-agent: Microsoft BITS/7.8
        Response
        HTTP/2.0 200
        date: Thu, 09 May 2024 16:35:47 GMT
        content-type: application/octet-stream
        content-length: 58919336
        server: BunnyCDN-FR1-951
        cdn-pullzone: 1654350
        cdn-uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028
        cdn-requestcountrycode: GB
        cache-control: public, max-age=259200
        last-modified: Mon, 29 Apr 2024 18:38:19 GMT
        cdn-storageserver: DE-664
        cdn-fileserver: 594
        cdn-proxyver: 1.04
        cdn-requestpullsuccess: True
        cdn-requestpullcode: 206
        cdn-cachedat: 05/06/2024 22:02:11
        cdn-edgestorageid: 1187
        cdn-status: 200
        cdn-requestid: ff50a03bc3023c7a02863a138d568ccd
        cdn-cache: HIT
        accept-ranges: bytes
      • flag-us
        DNS
        244.2.93.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        244.2.93.185.in-addr.arpa
        IN PTR
        Response
        244.2.93.185.in-addr.arpa
        IN PTR
        185-93-2-244 bunnyinfranet
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        u20w.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 192
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb5
        date: Thu, 09 May 2024 16:35:52 GMT
        set-cookie: SERVERID=svc5; path=/
        connection: close
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        westus2-2.in.applicationinsights.azure.com
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        Remote address:
        8.8.8.8:53
        Request
        westus2-2.in.applicationinsights.azure.com
        IN A
        Response
        westus2-2.in.applicationinsights.azure.com
        IN CNAME
        westus2-2.in.ai.monitor.azure.com
        westus2-2.in.ai.monitor.azure.com
        IN CNAME
        westus2-2.in.ai.privatelink.monitor.azure.com
        westus2-2.in.ai.privatelink.monitor.azure.com
        IN CNAME
        gig-ai-prod-westus2-0.trafficmanager.net
        gig-ai-prod-westus2-0.trafficmanager.net
        IN CNAME
        gig-ai-prod-wus2-02-app-v4-tag.westus2.cloudapp.azure.com
        gig-ai-prod-wus2-02-app-v4-tag.westus2.cloudapp.azure.com
        IN A
        20.9.155.150
      • flag-us
        POST
        https://westus2-2.in.applicationinsights.azure.com/v2/track
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        Remote address:
        20.9.155.150:443
        Request
        POST /v2/track HTTP/1.1
        Content-Type: application/x-json-stream
        Content-Encoding: gzip
        Host: westus2-2.in.applicationinsights.azure.com
        Content-Length: 845
        Expect: 100-continue
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Transfer-Encoding: chunked
        Content-Type: application/json; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        Date: Thu, 09 May 2024 16:36:02 GMT
      • flag-us
        DNS
        150.155.9.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        150.155.9.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        150.155.9.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        150.155.9.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        31.121.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        31.121.18.2.in-addr.arpa
        IN PTR
        Response
        31.121.18.2.in-addr.arpa
        IN PTR
        a2-18-121-31deploystaticakamaitechnologiescom
      • flag-us
        DNS
        0.204.248.87.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.204.248.87.in-addr.arpa
        IN PTR
        Response
        0.204.248.87.in-addr.arpa
        IN PTR
        https-87-248-204-0lhrllnwnet
      • flag-us
        DNS
        13.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.227.111.52.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.237:443
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZWKfFfByGQ0aAhVYxMQcLTVUCUx6bLkZJpRHf4Gjx1DlEQKqyhCqn3XiMVt_OWzDRX6owgN_UDBSDWx8AuGnryPTyQ6Kjjw_WsnZRdPopomhPWyN9lL6gNuH2p5eBDGn7uzaGFESZAd61OULW6vfunUS3TDg1vP45vDoC8FlspZNGg3D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D5ff24b92b12a15f5ee1c2da9d19fef97&TIME=20240508T112435Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
        tls, http2
        2.5kB
         9.0kB
         20
        17

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZWKfFfByGQ0aAhVYxMQcLTVUCUx6bLkZJpRHf4Gjx1DlEQKqyhCqn3XiMVt_OWzDRX6owgN_UDBSDWx8AuGnryPTyQ6Kjjw_WsnZRdPopomhPWyN9lL6gNuH2p5eBDGn7uzaGFESZAd61OULW6vfunUS3TDg1vP45vDoC8FlspZNGg3D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D5ff24b92b12a15f5ee1c2da9d19fef97&TIME=20240508T112435Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ZWKfFfByGQ0aAhVYxMQcLTVUCUx6bLkZJpRHf4Gjx1DlEQKqyhCqn3XiMVt_OWzDRX6owgN_UDBSDWx8AuGnryPTyQ6Kjjw_WsnZRdPopomhPWyN9lL6gNuH2p5eBDGn7uzaGFESZAd61OULW6vfunUS3TDg1vP45vDoC8FlspZNGg3D%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D5ff24b92b12a15f5ee1c2da9d19fef97&TIME=20240508T112435Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB

        HTTP Response

        204
      • 2.17.196.91:443
        https://www.bing.com/aes/c.gif?RG=5a6d7e1f932b47c1875f2a9cc12447b4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112435Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981
        tls, http2
        1.4kB
         5.3kB
         16
        11

        HTTP Request

        GET https://www.bing.com/aes/c.gif?RG=5a6d7e1f932b47c1875f2a9cc12447b4&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112435Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981

        HTTP Response

        200
      • 2.17.196.91:443
        https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        tls, http2
        1.6kB
         6.4kB
         16
        12

        HTTP Request

        GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

        HTTP Response

        200
      • 185.172.128.90:80
        http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
        http
        8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
        388 B
         280 B
         4
        3

        HTTP Request

        GET http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/ping.php?substr=two
        http
        8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
        374 B
         279 B
         4
        3

        HTTP Request

        GET http://185.172.128.228/ping.php?substr=two

        HTTP Response

        200
      • 185.172.128.59:80
        http://185.172.128.59/syncUpd.exe
        http
        8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
        4.3kB
         229.9kB
         90
        174

        HTTP Request

        GET http://185.172.128.59/syncUpd.exe

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/BroomSetup.exe
        http
        8eec6abf18ef5e6ce025c75d03744600_NeikiAnalytics.exe
        99.2kB
         5.0MB
         2096
        3747

        HTTP Request

        GET http://185.172.128.228/BroomSetup.exe

        HTTP Response

        200
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        u20w.1.exe
        836 B
         721 B
         6
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 185.93.2.244:443
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        tls, http2
        2.7MB
         62.3MB
         43202
        44742

        HTTP Request

        HEAD https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe

        HTTP Response

        200

        HTTP Request

        GET https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe

        HTTP Response

        200
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        u20w.1.exe
        836 B
         657 B
         6
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 185.172.128.150:80
        u20w.0.exe
        260 B
         5
      • 20.9.155.150:443
        https://westus2-2.in.applicationinsights.azure.com/v2/track
        tls, http
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        2.0kB
         5.2kB
         11
        10

        HTTP Request

        POST https://westus2-2.in.applicationinsights.azure.com/v2/track

        HTTP Response

        200
      • 185.172.128.150:80
        u20w.0.exe
        260 B
         5
      • 185.172.128.150:80
        u20w.0.exe
        260 B
         5
      • 185.172.128.150:80
        u20w.0.exe
        260 B
         5
      • 185.172.128.150:80
        u20w.0.exe
        260 B
         5
      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.237
        13.107.21.237

      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        237.197.79.204.in-addr.arpa
        dns
        73 B
         143 B
         1
        1

        DNS Request

        237.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        140.32.126.40.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        140.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        77.190.18.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        77.190.18.2.in-addr.arpa

      • 8.8.8.8:53
        91.196.17.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        91.196.17.2.in-addr.arpa

      • 8.8.8.8:53
        55.36.223.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        55.36.223.20.in-addr.arpa

      • 8.8.8.8:53
        90.128.172.185.in-addr.arpa
        dns
        73 B
         73 B
         1
        1

        DNS Request

        90.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        228.128.172.185.in-addr.arpa
        dns
        74 B
         74 B
         1
        1

        DNS Request

        228.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        59.128.172.185.in-addr.arpa
        dns
        73 B
         73 B
         1
        1

        DNS Request

        59.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        svc.iolo.com
        dns
        u20w.1.exe
        58 B
         74 B
         1
        1

        DNS Request

        svc.iolo.com

        DNS Response

        20.157.87.45

      • 8.8.8.8:53
        45.87.157.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        45.87.157.20.in-addr.arpa

      • 8.8.8.8:53
        download.iolo.net
        dns
        63 B
         105 B
         1
        1

        DNS Request

        download.iolo.net

        DNS Response

        185.93.2.244

      • 8.8.8.8:53
        244.2.93.185.in-addr.arpa
        dns
        71 B
         112 B
         1
        1

        DNS Request

        244.2.93.185.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        140 B
         156 B
         2
        1

        DNS Request

        50.23.12.20.in-addr.arpa

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
         145 B
         1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        westus2-2.in.applicationinsights.azure.com
        dns
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        88 B
         300 B
         1
        1

        DNS Request

        westus2-2.in.applicationinsights.azure.com

        DNS Response

        20.9.155.150

      • 8.8.8.8:53
        150.155.9.20.in-addr.arpa
        dns
        142 B
         157 B
         2
        1

        DNS Request

        150.155.9.20.in-addr.arpa

        DNS Request

        150.155.9.20.in-addr.arpa

      • 8.8.8.8:53
        31.121.18.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        31.121.18.2.in-addr.arpa

      • 8.8.8.8:53
        0.204.248.87.in-addr.arpa
        dns
        71 B
         116 B
         1
        1

        DNS Request

        0.204.248.87.in-addr.arpa

      • 8.8.8.8:53
        13.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        13.227.111.52.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
        Filesize

        3KB

        MD5

        de0d646eddf1ffa31dc65ca97f340143

        SHA1

        a2b092fbcff97f5b22487246b87a901b4382674f

        SHA256

        48dd4dce0967ecd1e36bf75432427b538d8627f7051877d0386c9fe1b29926d6

        SHA512

        06af675bdceff5fe2d79b8b0c5b4494a3d2e10287d83225f44e309b205d1e55ef08f99d1469a9a6030c8fead81088b938a5a521e6786b3a59a4adb854320ead0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\u20w.0.exe
        Filesize

        217KB

        MD5

        1485fe25a6d2bc50d097656c434822f1

        SHA1

        b8a4f204a92bad32df0e6af82a4ae04d71910ba9

        SHA256

        044d3469fd7a09f42ba4d342604e002f0ba770528747ba6d3cb7c4b77a975be6

        SHA512

        18346906dd80342281579602860c514f8e535bf25b3a0f1abe56f08aab52f203323b8d279e8df7c3723acf989aa0d438866675c22095386f8632a543b5dceaf0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\u20w.1.exe
        Filesize

        4.6MB

        MD5

        397926927bca55be4a77839b1c44de6e

        SHA1

        e10f3434ef3021c399dbba047832f02b3c898dbd

        SHA256

        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

        SHA512

        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

        Download Submit

      • memory/1672-66-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/1672-54-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2272-88-0x000001CE6EAD0000-0x000001CE6EADA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2272-78-0x000001CE4F1B0000-0x000001CE4F1BA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2272-97-0x000001CE69950000-0x000001CE6996E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/2272-95-0x000001CE6E950000-0x000001CE6E9C6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/2272-94-0x000001CE6E870000-0x000001CE6E87C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2272-91-0x000001CE6F080000-0x000001CE6F5A8000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/2272-90-0x000001CE6E850000-0x000001CE6E872000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2272-89-0x000001CE6EAF0000-0x000001CE6EB52000-memory.dmp

        Filesize

        392KB

        Download

      • memory/2272-67-0x000001CE49A80000-0x000001CE4D2B4000-memory.dmp

        Filesize

        56.2MB

        Download

      • memory/2272-68-0x000001CE69390000-0x000001CE6949A000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/2272-69-0x000001CE4D710000-0x000001CE4D720000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2272-70-0x000001CE4D850000-0x000001CE4D85C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2272-71-0x000001CE4D840000-0x000001CE4D854000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2272-72-0x000001CE4F140000-0x000001CE4F164000-memory.dmp

        Filesize

        144KB

        Download

      • memory/2272-73-0x000001CE4F160000-0x000001CE4F16A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2272-74-0x000001CE4F170000-0x000001CE4F19A000-memory.dmp

        Filesize

        168KB

        Download

      • memory/2272-75-0x000001CE691D0000-0x000001CE69282000-memory.dmp

        Filesize

        712KB

        Download

      • memory/2272-76-0x000001CE695E0000-0x000001CE69630000-memory.dmp

        Filesize

        320KB

        Download

      • memory/2272-77-0x000001CE67A60000-0x000001CE67A82000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2272-87-0x000001CE6D950000-0x000001CE6D958000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2272-82-0x000001CE69630000-0x000001CE69930000-memory.dmp

        Filesize

        3.0MB

        Download

      • memory/2272-84-0x000001CE6D9E0000-0x000001CE6D9E8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2272-85-0x000001CE6D960000-0x000001CE6D998000-memory.dmp

        Filesize

        224KB

        Download

      • memory/2272-86-0x000001CE6D930000-0x000001CE6D93E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2576-96-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/2576-106-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/2576-104-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/2576-102-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/2576-55-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/2576-100-0x0000000000400000-0x0000000002AF3000-memory.dmp

        Filesize

        38.9MB

        Download

      • memory/2624-3-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

        Download

      • memory/2624-31-0x0000000000400000-0x0000000002B22000-memory.dmp

        Filesize

        39.1MB

        Download

      • memory/2624-32-0x0000000002ED0000-0x0000000002F3C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2624-16-0x0000000000400000-0x0000000002B22000-memory.dmp

        Filesize

        39.1MB

        Download

      • memory/2624-33-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

        Download

      • memory/2624-2-0x0000000002ED0000-0x0000000002F3C000-memory.dmp

        Filesize

        432KB

        Download

      • memory/2624-1-0x0000000002B30000-0x0000000002C30000-memory.dmp

        Filesize

        1024KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.