Overview

overview

10

Static

static

1

5654c63a63...9f.exe

windows7-x64

10

5654c63a63...9f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10-05-2024 01:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe

  • Size

    389KB

  • MD5

    b8974e005f6850373862db8ec43c739d

  • SHA1

    da18ff2135677c6e6ec438fd5a3cc86f274b2072

  • SHA256

    5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f

  • SHA512

    79d002d26fabbcf9807d7b4ceec0244b27a192601f4c654438324153a258dff165925cca6d882a297240d335e935cda0dab25af67666596bc7142f1ef4ace385

  • SSDEEP

    6144:VoavxgYvX2ZXThTtP8KVa2txCbPhou247E/VnX+Q2EVGxm5mwhQ4bkSp:VoaJgnXTpR8KVatbV8OEIralJ

Score
10/10
gluptebastealczgratdiscoverydropperevasionexecutionloaderpersistenceratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 2 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 16 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 9 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detect binaries embedding considerable number of MFA browser extension IDs. 4 IoCs
  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs
  • Detects Windows executables referencing non-Windows User-Agents 17 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 4 IoCs
  • Detects executables (downlaoders) containing URLs to raw contents of a paste 5 IoCs
  • Detects executables Discord URL observed in first stage droppers 17 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 17 IoCs
  • Detects executables containing artifacts associated with disabling Widnows Defender 17 IoCs
  • Detects executables packed with or use KoiVM 1 IoCs
  • Detects executables referencing many varying, potentially fake Windows User-Agents 17 IoCs
  • Modifies boot configuration data using bcdedit 14 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Drops startup file 7 IoCs
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 36 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 9 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 4 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 9 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe
    "C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe"
    1⤵
    • UAC bypass
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1772
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5654c63a63abcd7abe77c36cdb8c6e68379694ba69d38c0c0fed37be52c5a09f.exe" -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      2⤵
        PID:2576
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        2⤵
        • Drops startup file
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\Pictures\F2LuyPGDl9UMeeJs2PsL6d5n.exe
          "C:\Users\Admin\Pictures\F2LuyPGDl9UMeeJs2PsL6d5n.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1500
          • C:\Users\Admin\Pictures\F2LuyPGDl9UMeeJs2PsL6d5n.exe
            "C:\Users\Admin\Pictures\F2LuyPGDl9UMeeJs2PsL6d5n.exe"
            4⤵
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2320
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2960
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                • Modifies data under HKEY_USERS
                PID:2768
        • C:\Users\Admin\Pictures\jHsi51dPIgen6vovr3mGN3oR.exe
          "C:\Users\Admin\Pictures\jHsi51dPIgen6vovr3mGN3oR.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:708
          • C:\Users\Admin\Pictures\jHsi51dPIgen6vovr3mGN3oR.exe
            "C:\Users\Admin\Pictures\jHsi51dPIgen6vovr3mGN3oR.exe"
            4⤵
            • Windows security bypass
            • Executes dropped EXE
            • Loads dropped DLL
            • Windows security modification
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2804
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2944
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                6⤵
                • Modifies Windows Firewall
                PID:2780
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              5⤵
              • Drops file in Drivers directory
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Manipulates WinMon driver.
              • Manipulates WinMonFS driver.
              • Drops file in Windows directory
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:2820
              • C:\Windows\system32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • Creates scheduled task(s)
                PID:2060
              • C:\Windows\system32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                6⤵
                  PID:2080
                • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                  "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Modifies system certificate store
                  PID:2988
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1276
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2692
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1048
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1244
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:848
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1444
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1968
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1492
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1032
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2872
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1272
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -timeout 0
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2908
                  • C:\Windows\system32\bcdedit.exe
                    C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                    7⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1200
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2088
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\Sysnative\bcdedit.exe /v
                  6⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1528
                • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                  6⤵
                  • Executes dropped EXE
                  PID:2072
                • C:\Windows\system32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • Creates scheduled task(s)
                  PID:892
                • C:\Windows\windefender.exe
                  "C:\Windows\windefender.exe"
                  6⤵
                  • Executes dropped EXE
                  PID:2972
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                    7⤵
                      PID:996
                      • C:\Windows\SysWOW64\sc.exe
                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                        8⤵
                        • Launches sc.exe
                        • Suspicious use of AdjustPrivilegeToken
                        PID:616
            • C:\Users\Admin\Pictures\NgBlONli6MyRcs4oApFuwB8v.exe
              "C:\Users\Admin\Pictures\NgBlONli6MyRcs4oApFuwB8v.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2136
              • C:\Users\Admin\Pictures\NgBlONli6MyRcs4oApFuwB8v.exe
                "C:\Users\Admin\Pictures\NgBlONli6MyRcs4oApFuwB8v.exe"
                4⤵
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Adds Run key to start application
                • Checks for VirtualBox DLLs, possible anti-VM trick
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2604
                • C:\Windows\system32\cmd.exe
                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                  5⤵
                    PID:1740
                    • C:\Windows\system32\netsh.exe
                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                      6⤵
                      • Modifies Windows Firewall
                      • Modifies data under HKEY_USERS
                      PID:1296
              • C:\Users\Admin\Pictures\O05cSDQhdrVskWPUlp2qyBtR.exe
                "C:\Users\Admin\Pictures\O05cSDQhdrVskWPUlp2qyBtR.exe"
                3⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2304
                • C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u1s0.0.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2624
                • C:\Users\Admin\AppData\Local\Temp\u1s0.1.exe
                  "C:\Users\Admin\AppData\Local\Temp\u1s0.1.exe"
                  4⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1908
                  • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                    "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                    5⤵
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2716
              • C:\Users\Admin\Pictures\vZrLF5GFVHoAt8olITDSKUPp.exe
                "C:\Users\Admin\Pictures\vZrLF5GFVHoAt8olITDSKUPp.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2492
                • C:\Users\Admin\Pictures\vZrLF5GFVHoAt8olITDSKUPp.exe
                  "C:\Users\Admin\Pictures\vZrLF5GFVHoAt8olITDSKUPp.exe"
                  4⤵
                  • Executes dropped EXE
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2328
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 1772 -s 848
              2⤵
                PID:2480
            • C:\Windows\system32\makecab.exe
              "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240510012244.log C:\Windows\Logs\CBS\CbsPersist_20240510012244.cab
              1⤵
              • Drops file in Windows directory
              PID:1092
            • C:\Windows\windefender.exe
              C:\Windows\windefender.exe
              1⤵
              • Executes dropped EXE
              PID:2100

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            PowerShell

            1
            T1059.001

            Scheduled Task/Job

            1
            T1053

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            5
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Disable or Modify Tools

            3
            T1562.001

            Modify Registry

            6
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Credential Access

            Unsecured Credentials

            3
            T1552

            Credentials In Files

            3
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            4
            T1012

            System Information Discovery

            5
            T1082

            Lateral Movement

            Collection

            Data from Local System

            3
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
              Filesize

              68KB

              MD5

              29f65ba8e88c063813cc50a4ea544e93

              SHA1

              05a7040d5c127e68c25d81cc51271ffb8bef3568

              SHA256

              1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

              SHA512

              e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              344B

              MD5

              294b2f78e0f5d07c9d781addbc0858ca

              SHA1

              fb4269ccf99443f9c16385ba6fecfd6ddcc69902

              SHA256

              f5c9f5b4ca518c68ceab9bdf968da177e41cdfdaaf5b185c3c0250fa0e8eef1f

              SHA512

              02042d52c64a26e2961b9c01c1e9849c6d5ee7b0c81b8f2e4e8e8441c9736a1e48f37f66e455f2dc133aaa0348666dc7f91b75a2ed482b3712cfbd1244918add

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              344B

              MD5

              d4d8020ed8ff9f0286fd9f95d5bbb40e

              SHA1

              d941f29e2ae3fcbf7f2f77ac9134ca2d0f918957

              SHA256

              b4309feb211924eb8b86228e2cdf27d83b41e373cddd9e71dbfbe57e3e478582

              SHA512

              178ed968cf1ac4b01bde8c3482374e45a69b4906d5715cdeb7cfcb48befa1b0e4ade22fe67080259398ac39bd85acbf168bfd35286805218552d402ff34c7d9a

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
              Filesize

              344B

              MD5

              b90dac16bbe441dc30e3f2535490f0df

              SHA1

              084099eec19c0924c8ec2b0dc2b915832fc29fb8

              SHA256

              9705aa249ad7c47eec4d1ec97af8e0d75509d2b88b760aeff1d66a10205b0a8e

              SHA512

              4683fa692f83bfcf0e6f6a9c4c3335d37c8c216da85102449e532c62e992d7a6043ae60f7c66ad591b09326b3eee18553f76c7e6f6ee8c03ff1dcaf8c7dba14f

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\252e99e709753c2ab04b66e213ab7d72cfdb494a7016e07d23bc17fe7cebab94\114f703f588b497a85fb5ee818fd93f2.tmp
              Filesize

              1KB

              MD5

              da71942d08254b3cb61f31f6cbe6f8e0

              SHA1

              cdaaa45d2f050fd4f1dcf4960750b12a85a2c5d5

              SHA256

              8eb68f6d24c5bf7ace5b154a4888869a2bb96e42c697bd1fa11d0f405c881d39

              SHA512

              1b976ae5cfe11c3ee298a816905d781ac2fd324cbaabbf5dce7da9df9430d2a2a6ba5a5ab2643a72d939b57c81ff93fa9257013f6ed26f64f7b95cc3af160101

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Cab2DB7.tmp
              Filesize

              65KB

              MD5

              ac05d27423a85adc1622c714f2cb6184

              SHA1

              b0fe2b1abddb97837ea0195be70ab2ff14d43198

              SHA256

              c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

              SHA512

              6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
              Filesize

              8.3MB

              MD5

              fd2727132edd0b59fa33733daa11d9ef

              SHA1

              63e36198d90c4c2b9b09dd6786b82aba5f03d29a

              SHA256

              3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

              SHA512

              3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
              Filesize

              492KB

              MD5

              fafbf2197151d5ce947872a4b0bcbe16

              SHA1

              a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

              SHA256

              feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

              SHA512

              acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Tar2F9D.tmp
              Filesize

              171KB

              MD5

              9c0c641c06238516f27941aa1166d427

              SHA1

              64cd549fb8cf014fcd9312aa7a5b023847b6c977

              SHA256

              4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

              SHA512

              936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Tar307E.tmp
              Filesize

              177KB

              MD5

              435a9ac180383f9fa094131b173a2f7b

              SHA1

              76944ea657a9db94f9a4bef38f88c46ed4166983

              SHA256

              67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

              SHA512

              1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
              Filesize

              281KB

              MD5

              d98e33b66343e7c96158444127a117f6

              SHA1

              bb716c5509a2bf345c6c1152f6e3e1452d39d50d

              SHA256

              5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

              SHA512

              705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
              Filesize

              2KB

              MD5

              85091ed3ade176044a043c9f4ae8f102

              SHA1

              ebab0a99a57c54a73971f5a030a575819505edf6

              SHA256

              cb16a38763f2eba2c4bf5e940303a1c2e5ba1dc18affe5f81d1d79c1635c30da

              SHA512

              4daf88a0cd5051fc781f2f334220c8a04de5538ad7bb016bb43fe13eba51a05da6c8461c8ce57be6cec63e295026f914558cfe701a7e9423426c39a2d4eaa2fa

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
              Filesize

              5.3MB

              MD5

              1afff8d5352aecef2ecd47ffa02d7f7d

              SHA1

              8b115b84efdb3a1b87f750d35822b2609e665bef

              SHA256

              c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

              SHA512

              e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

              Download Submit

            • C:\Users\Admin\Pictures\F2LuyPGDl9UMeeJs2PsL6d5n.exe
              Filesize

              4.1MB

              MD5

              34e8369309638e9468c65df8d546e9ec

              SHA1

              f6296bdb66b9f188a9093d0f2e3edaf3dfd5ed9f

              SHA256

              bc09d4cc90b0e7b582c6ed7010277377aff00042d7469cb2e9f11f775cef4605

              SHA512

              b792981f6e855fcab23dbb078f5aa2398c6c4175b4b151a656174b756de936bc388d2fa2c8432a9b9120256e5db9ebbfca38a12d60bc085f744988ef1a726c48

              Download Submit

            • C:\Users\Admin\Pictures\F2LuyPGDl9UMeeJs2PsL6d5n.exe
              Filesize

              2.0MB

              MD5

              d7b826b6afcdc453bbcfec7612012024

              SHA1

              9f7e5abdc6b0b838faf56c12f93fcac82131a4e1

              SHA256

              8ebfb0a261d2332f69a8fe499a4af93e5298340bcb5846f4c98bbadaf2ec3812

              SHA512

              15e061c32561151473ccd16d0d2f814634ebdd3f56b5e2a3eb80bff07aa5fd0fa2a26c54119a8461b2e59e6603dc6bd6f34231fc13352affc1dc3aaa9791e33d

              Download Submit

            • C:\Users\Admin\Pictures\NgBlONli6MyRcs4oApFuwB8v.exe
              Filesize

              3.0MB

              MD5

              f20e81522dfa1a0bc82088ca9165af18

              SHA1

              d7fa828e6592bb94c1b60fbdbe3a21d217145323

              SHA256

              90e8cfe2dc4ee40715f8d25bca67f4ff7d9cb0b2ee3fe7436951d861e7a0f89e

              SHA512

              3bae0065729478ed9200c58ec0363cf5f06ca7401f62c2df4431cb70968760221a6c80add41471bdc2fafc3497caa66d28f4dd06a2dbc9d004e42c612bd8624a

              Download Submit

            • C:\Users\Admin\Pictures\NgBlONli6MyRcs4oApFuwB8v.exe
              Filesize

              2.8MB

              MD5

              d34dc724304b2356982c555aa92f8bcc

              SHA1

              7f128e5cc1a6577fc8e109451316c977bd3b4db0

              SHA256

              060418d5424b39a031bf7ba01045a8dbbce2f8aa26712eb18831111630e7a2ca

              SHA512

              9bc20dfea0f10655f10790f2483f6864de6441f3a0212c3d94de8b155a89bfe834e9d836f9dfa33ed825aee2b5fc3eb0169e2f33c734897733df94076e5e4093

              Download Submit

            • C:\Users\Admin\Pictures\O05cSDQhdrVskWPUlp2qyBtR.exe
              Filesize

              384KB

              MD5

              58abc76e3bf16ebe939c3fb841129b5b

              SHA1

              8860684923c2d64551ca6175ea63e34e11e89599

              SHA256

              8773907e6db3869856293c19c8fbee567854ca17e8c4dd580ee8a05fe3f1b0a7

              SHA512

              ab3964c57c1ce0b4db2da147b40f0c058b65848c4fe21a7fc4f6fa026378d7b0861005a4111a9ea469245b0ff75d31c3db3550204951783637a77e2c559a4aef

              Download Submit

            • C:\Users\Admin\Pictures\jHsi51dPIgen6vovr3mGN3oR.exe
              Filesize

              2.5MB

              MD5

              b1b897b35a72c8a795bab7a7850a7041

              SHA1

              3d7fefc4e2cbb148a05c6d244925a999282f49f6

              SHA256

              205034103150d565d085da11a2861bec4b800e620a818e78fe6b3dfc96c7ef42

              SHA512

              25c3982631181e4bd190c106b03e869903bd099b7476704a92f440e3f10a8a5810bd16f7b3f87b5dd9ecfea843cf960e44e0e6ace2366d50c4236be6481923af

              Download Submit

            • C:\Windows\rss\csrss.exe
              Filesize

              1.1MB

              MD5

              9d9d8f10b7cf4ac07ad801583da10867

              SHA1

              44f62c6b466b7b24e6d4ce836c07ac50a5092ce8

              SHA256

              eb0e4112feb0aca67f19d419d6e309a74b3482bad45d5352860dd0ee9a05ffdf

              SHA512

              2c2f3a8d18a45f037e8b8f8a73482bf12322f6b057f198aea756d8c8a02f5039257e14813878035fb4842926c2522e8e26d75ad1c9e3afc0941753c56707a5e1

              Download Submit

            • C:\Windows\windefender.exe
              Filesize

              2.0MB

              MD5

              8e67f58837092385dcf01e8a2b4f5783

              SHA1

              012c49cfd8c5d06795a6f67ea2baf2a082cf8625

              SHA256

              166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

              SHA512

              40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

              Download Submit

            • \ProgramData\mozglue.dll
              Filesize

              593KB

              MD5

              c8fd9be83bc728cc04beffafc2907fe9

              SHA1

              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

              SHA256

              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

              SHA512

              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

              Download Submit

            • \ProgramData\nss3.dll
              Filesize

              2.0MB

              MD5

              1cc453cdf74f31e4d913ff9c10acdde2

              SHA1

              6e85eae544d6e965f15fa5c39700fa7202f3aafe

              SHA256

              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

              SHA512

              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

              Download Submit

            • \Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
              Filesize

              94KB

              MD5

              d98e78fd57db58a11f880b45bb659767

              SHA1

              ab70c0d3bd9103c07632eeecee9f51d198ed0e76

              SHA256

              414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0

              SHA512

              aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831

              Download Submit

            • \Users\Admin\AppData\Local\Temp\csrss\patch.exe
              Filesize

              1.7MB

              MD5

              13aaafe14eb60d6a718230e82c671d57

              SHA1

              e039dd924d12f264521b8e689426fb7ca95a0a7b

              SHA256

              f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

              SHA512

              ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

              Download Submit

            • \Users\Admin\AppData\Local\Temp\dbghelp.dll
              Filesize

              1.5MB

              MD5

              f0616fa8bc54ece07e3107057f74e4db

              SHA1

              b33995c4f9a004b7d806c4bb36040ee844781fca

              SHA256

              6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

              SHA512

              15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

              Download Submit

            • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
              Filesize

              2.8MB

              MD5

              5d4da2e9bb55c5a352fbd486505176a1

              SHA1

              6b1d06db1301292cfce31031e4bcb08cb29bb669

              SHA256

              3e2168e94fe2af3c14fc985a852aeee83ede6f068b84809254941dfd045c7158

              SHA512

              22a0eeed4389cb1b458ca4d8fa644ed35d2d2c06e164fadf3054f6207a593704abbe4b9e53908ab540c2b844a501f75d30cb6125c28b08e677111a4de92b8e01

              Download Submit

            • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
              Filesize

              1.8MB

              MD5

              c41c3be9c15587a82952179c1c4467e3

              SHA1

              4015bd6d980e260c3bf759c37ef1463fd4d88bc2

              SHA256

              ab3ca69ff0282d028f4b8460e921d37553e98ebf12c6a9f8c6741875d889e9d3

              SHA512

              17c69a1d66c53d82036806e82fe849570052853839eeefde1f9cb4ec5e3628ed7dc3d06d453b9f35fd7cf51abb8006c78322841ad37829d6b87638fc7060f4a5

              Download Submit

            • \Users\Admin\AppData\Local\Temp\osloader.exe
              Filesize

              591KB

              MD5

              e2f68dc7fbd6e0bf031ca3809a739346

              SHA1

              9c35494898e65c8a62887f28e04c0359ab6f63f5

              SHA256

              b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

              SHA512

              26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

              Download Submit

            • \Users\Admin\AppData\Local\Temp\symsrv.dll
              Filesize

              163KB

              MD5

              5c399d34d8dc01741269ff1f1aca7554

              SHA1

              e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

              SHA256

              e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

              SHA512

              8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

              Download Submit

            • \Users\Admin\AppData\Local\Temp\u1s0.0.exe
              Filesize

              206KB

              MD5

              a33065159222d4c22e581ea419285701

              SHA1

              6297d390c9d8c3b8c3340d8d38d46c1bbf32d354

              SHA256

              ddf2f47cbc0db66b326be096b46854a6ab59a2504688077bba0bbb42c4470ae2

              SHA512

              2860dab79524b7db3f0b7771b8d402905a8096653d1c83e49e3827bb7cd739104848b691be16fbd898b81bfd4fcdd827fc4c8f72da6e91d565f02e59f5725f79

              Download Submit

            • \Users\Admin\AppData\Local\Temp\u1s0.1.exe
              Filesize

              4.6MB

              MD5

              397926927bca55be4a77839b1c44de6e

              SHA1

              e10f3434ef3021c399dbba047832f02b3c898dbd

              SHA256

              4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

              SHA512

              cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

              Download Submit

            • \Users\Admin\Pictures\NgBlONli6MyRcs4oApFuwB8v.exe
              Filesize

              4.1MB

              MD5

              b4edadf4b8fc4c176cef6830ab7d3177

              SHA1

              6f93a98295f5b4a514870db5c50d000f3d644264

              SHA256

              241ec7b24544cef6c5762622c25c91621f0dd20c9154dcf20c83932d2c3496e5

              SHA512

              dc727e1cbe252fdfbc866ac4dad3d256038535b32d437d8d17e537c8723b1b8f51da6e0de4a7ac53295cf091fcf93591907f1bd2487618c542bc96e8616232dc

              Download Submit

            • \Users\Admin\Pictures\vZrLF5GFVHoAt8olITDSKUPp.exe
              Filesize

              1.2MB

              MD5

              b5cefdaa3baf3106eaac1389edac2eb9

              SHA1

              ca8f379ca3c565c459d4bd84fa0f5e68ceee3ff7

              SHA256

              046300b1c955500c85d8b26f69494758015f53c94ea9a64df27b183f939a656a

              SHA512

              2c42a1acd3582de3363d036c8389b300d477e3944bc15e6cdd387acdd2eef2e5950acbceb22013678fd915a2df150848ddcc76bc7e56af78e7598c3c36b7357c

              Download Submit

            • \Windows\rss\csrss.exe
              Filesize

              2.8MB

              MD5

              5d0412e2b76f8348bb64a25fcbb9d5f7

              SHA1

              eaa4c395a7932ace0b327108158095aadd3cde26

              SHA256

              963fa82b410b947db4fb4db8de3ffc6efc37ece176f34731a107a18c01495b8d

              SHA512

              16276c968a66ee13fd3f7d6587a23b344066b712e19f5d7fe90591bdf2e59ccd5cea8f7817030639900bbdf442eaccaf99773b205ff045d85992643fad2f36bd

              Download Submit

            • memory/708-203-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/708-184-0x0000000002F30000-0x0000000003328000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/1500-204-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/1500-172-0x00000000031F0000-0x00000000035E8000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/1772-347-0x000007FEF5CA3000-0x000007FEF5CA4000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1772-3-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

              Filesize

              9.9MB

              Download

            • memory/1772-2-0x0000000002010000-0x000000000206E000-memory.dmp

              Filesize

              376KB

              Download

            • memory/1772-352-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

              Filesize

              9.9MB

              Download

            • memory/1772-0-0x000007FEF5CA3000-0x000007FEF5CA4000-memory.dmp

              Filesize

              4KB

              Download

            • memory/1772-1-0x00000000000A0000-0x00000000000AA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/1908-465-0x0000000000400000-0x00000000008AD000-memory.dmp

              Filesize

              4.7MB

              Download

            • memory/2100-577-0x0000000000400000-0x00000000008DF000-memory.dmp

              Filesize

              4.9MB

              Download

            • memory/2100-579-0x0000000000400000-0x00000000008DF000-memory.dmp

              Filesize

              4.9MB

              Download

            • memory/2136-197-0x00000000030A0000-0x0000000003498000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2136-217-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2304-406-0x0000000000400000-0x0000000002B1E000-memory.dmp

              Filesize

              39.1MB

              Download

            • memory/2304-351-0x0000000000400000-0x0000000002B1E000-memory.dmp

              Filesize

              39.1MB

              Download

            • memory/2320-202-0x00000000030F0000-0x00000000034E8000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2320-246-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2328-253-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2328-250-0x0000000003220000-0x0000000003618000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2492-230-0x0000000003050000-0x0000000003448000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2492-249-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2600-8-0x0000000002A40000-0x0000000002AC0000-memory.dmp

              Filesize

              512KB

              Download

            • memory/2600-9-0x000000001B670000-0x000000001B952000-memory.dmp

              Filesize

              2.9MB

              Download

            • memory/2600-10-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2604-216-0x00000000030C0000-0x00000000034B8000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2604-251-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2624-437-0x0000000000400000-0x0000000002AF1000-memory.dmp

              Filesize

              38.9MB

              Download

            • memory/2624-364-0x0000000061E00000-0x0000000061EF3000-memory.dmp

              Filesize

              972KB

              Download

            • memory/2624-516-0x0000000000400000-0x0000000002AF1000-memory.dmp

              Filesize

              38.9MB

              Download

            • memory/2624-391-0x0000000000400000-0x0000000002AF1000-memory.dmp

              Filesize

              38.9MB

              Download

            • memory/2624-508-0x0000000000400000-0x0000000002AF1000-memory.dmp

              Filesize

              38.9MB

              Download

            • memory/2712-22-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2712-20-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2712-17-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2712-11-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2712-13-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2712-15-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2712-21-0x0000000000400000-0x0000000000408000-memory.dmp

              Filesize

              32KB

              Download

            • memory/2712-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2716-500-0x000000001E450000-0x000000001E472000-memory.dmp

              Filesize

              136KB

              Download

            • memory/2716-515-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2716-473-0x0000000000410000-0x0000000000420000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2716-485-0x000000001E940000-0x000000001E9F2000-memory.dmp

              Filesize

              712KB

              Download

            • memory/2716-484-0x0000000000BA0000-0x0000000000BCA000-memory.dmp

              Filesize

              168KB

              Download

            • memory/2716-483-0x00000000001F0000-0x00000000001FA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2716-490-0x0000000000200000-0x000000000020A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2716-494-0x000000001FC20000-0x000000001FF20000-memory.dmp

              Filesize

              3.0MB

              Download

            • memory/2716-497-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2716-496-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2716-498-0x0000000001320000-0x000000000132A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2716-472-0x000000001EE00000-0x000000001EF0A000-memory.dmp

              Filesize

              1.0MB

              Download

            • memory/2716-499-0x000000001EC00000-0x000000001EC62000-memory.dmp

              Filesize

              392KB

              Download

            • memory/2716-503-0x0000000001330000-0x000000000133C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2716-476-0x000000001DF80000-0x000000001DFA4000-memory.dmp

              Filesize

              144KB

              Download

            • memory/2716-474-0x0000000000590000-0x000000000059C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/2716-471-0x0000000001340000-0x0000000004B74000-memory.dmp

              Filesize

              56.2MB

              Download

            • memory/2716-514-0x0000000000BE0000-0x0000000000BEA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/2716-475-0x0000000000420000-0x0000000000434000-memory.dmp

              Filesize

              80KB

              Download

            • memory/2804-245-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2804-200-0x00000000030C0000-0x00000000034B8000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2820-517-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-505-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-533-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-534-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-540-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-541-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-523-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-244-0x00000000031A0000-0x0000000003598000-memory.dmp

              Filesize

              4.0MB

              Download

            • memory/2820-552-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-532-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-580-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-571-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-436-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2820-387-0x0000000000400000-0x0000000002ED5000-memory.dmp

              Filesize

              42.8MB

              Download

            • memory/2972-578-0x0000000000400000-0x00000000008DF000-memory.dmp

              Filesize

              4.9MB

              Download

            • memory/2972-575-0x0000000000400000-0x00000000008DF000-memory.dmp

              Filesize

              4.9MB

              Download

            • memory/2988-273-0x0000000140000000-0x00000001405E8000-memory.dmp

              Filesize

              5.9MB

              Download

            • memory/2988-259-0x0000000140000000-0x00000001405E8000-memory.dmp

              Filesize

              5.9MB

              Download