b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Transferencia.exe
Size

431KB
MD5

07cbab426f1bc77ca5d0f6a8fc1c9b4b
SHA1

70dc25df196c9bd87c2add428dc86b5f272eb15c
SHA256

b7f32eba711b23c10467841163a1d84b4002f99b16399b7356eee0e2abe651df
SHA512

a53c41aa20e76b7ee3baaa08aee3a4aa5361314a677ca753f68e1aca607fc8c8fdb3ab4f932991662976db2e1e30b5632bb7ebc5c12aa24dcb6703b5f311c9d7
SSDEEP

12288:Q0pZnHL9jAT8mU07ijSq/X7/8omMZ8LliOPZx:Q0pZnrhVG7imq/TdmMZ8Dx

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe
1704	Transferencia.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	drive.google.com
5	drive.google.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\undergrundslitteraturernes\warstlers.ini	Transferencia.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3040	Transferencia.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1704	Transferencia.exe
3040	Transferencia.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1704 set thread context of 3040	1704	Transferencia.exe	574
PID 3040 set thread context of 1192	3040	Transferencia.exe	21
PID 3040 set thread context of 1368	3040	Transferencia.exe	577
PID 1368 set thread context of 1192	1368	dvdplay.exe	21

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\starflower.thu	Transferencia.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-481678230-3773327859-3495911762-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	dvdplay.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3040	Transferencia.exe
3040	Transferencia.exe
3040	Transferencia.exe
3040	Transferencia.exe
3040	Transferencia.exe
3040	Transferencia.exe
3040	Transferencia.exe
3040	Transferencia.exe
1368	dvdplay.exe
1368	dvdplay.exe
1368	dvdplay.exe
1368	dvdplay.exe
1368	dvdplay.exe
1368	dvdplay.exe
1368	dvdplay.exe
1368	dvdplay.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1704	Transferencia.exe
3040	Transferencia.exe
1192	Explorer.EXE
1192	Explorer.EXE
1368	dvdplay.exe
1368	dvdplay.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2820	1704	Transferencia.exe	28
PID 1704 wrote to memory of 2820	1704	Transferencia.exe	28
PID 1704 wrote to memory of 2820	1704	Transferencia.exe	28
PID 1704 wrote to memory of 2820	1704	Transferencia.exe	28
PID 1704 wrote to memory of 2440	1704	Transferencia.exe	30
PID 1704 wrote to memory of 2440	1704	Transferencia.exe	30
PID 1704 wrote to memory of 2440	1704	Transferencia.exe	30
PID 1704 wrote to memory of 2440	1704	Transferencia.exe	30
PID 1704 wrote to memory of 2712	1704	Transferencia.exe	32
PID 1704 wrote to memory of 2712	1704	Transferencia.exe	32
PID 1704 wrote to memory of 2712	1704	Transferencia.exe	32
PID 1704 wrote to memory of 2712	1704	Transferencia.exe	32
PID 1704 wrote to memory of 2656	1704	Transferencia.exe	34
PID 1704 wrote to memory of 2656	1704	Transferencia.exe	34
PID 1704 wrote to memory of 2656	1704	Transferencia.exe	34
PID 1704 wrote to memory of 2656	1704	Transferencia.exe	34
PID 1704 wrote to memory of 2312	1704	Transferencia.exe	36
PID 1704 wrote to memory of 2312	1704	Transferencia.exe	36
PID 1704 wrote to memory of 2312	1704	Transferencia.exe	36
PID 1704 wrote to memory of 2312	1704	Transferencia.exe	36
PID 1704 wrote to memory of 2524	1704	Transferencia.exe	38
PID 1704 wrote to memory of 2524	1704	Transferencia.exe	38
PID 1704 wrote to memory of 2524	1704	Transferencia.exe	38
PID 1704 wrote to memory of 2524	1704	Transferencia.exe	38
PID 1704 wrote to memory of 2544	1704	Transferencia.exe	40
PID 1704 wrote to memory of 2544	1704	Transferencia.exe	40
PID 1704 wrote to memory of 2544	1704	Transferencia.exe	40
PID 1704 wrote to memory of 2544	1704	Transferencia.exe	40
PID 1704 wrote to memory of 2492	1704	Transferencia.exe	42
PID 1704 wrote to memory of 2492	1704	Transferencia.exe	42
PID 1704 wrote to memory of 2492	1704	Transferencia.exe	42
PID 1704 wrote to memory of 2492	1704	Transferencia.exe	42
PID 1704 wrote to memory of 2668	1704	Transferencia.exe	44
PID 1704 wrote to memory of 2668	1704	Transferencia.exe	44
PID 1704 wrote to memory of 2668	1704	Transferencia.exe	44
PID 1704 wrote to memory of 2668	1704	Transferencia.exe	44
PID 1704 wrote to memory of 2184	1704	Transferencia.exe	46
PID 1704 wrote to memory of 2184	1704	Transferencia.exe	46
PID 1704 wrote to memory of 2184	1704	Transferencia.exe	46
PID 1704 wrote to memory of 2184	1704	Transferencia.exe	46
PID 1704 wrote to memory of 2844	1704	Transferencia.exe	48
PID 1704 wrote to memory of 2844	1704	Transferencia.exe	48
PID 1704 wrote to memory of 2844	1704	Transferencia.exe	48
PID 1704 wrote to memory of 2844	1704	Transferencia.exe	48
PID 1704 wrote to memory of 2884	1704	Transferencia.exe	50
PID 1704 wrote to memory of 2884	1704	Transferencia.exe	50
PID 1704 wrote to memory of 2884	1704	Transferencia.exe	50
PID 1704 wrote to memory of 2884	1704	Transferencia.exe	50
PID 1704 wrote to memory of 3052	1704	Transferencia.exe	52
PID 1704 wrote to memory of 3052	1704	Transferencia.exe	52
PID 1704 wrote to memory of 3052	1704	Transferencia.exe	52
PID 1704 wrote to memory of 3052	1704	Transferencia.exe	52
PID 1704 wrote to memory of 2780	1704	Transferencia.exe	54
PID 1704 wrote to memory of 2780	1704	Transferencia.exe	54
PID 1704 wrote to memory of 2780	1704	Transferencia.exe	54
PID 1704 wrote to memory of 2780	1704	Transferencia.exe	54
PID 1704 wrote to memory of 2740	1704	Transferencia.exe	56
PID 1704 wrote to memory of 2740	1704	Transferencia.exe	56
PID 1704 wrote to memory of 2740	1704	Transferencia.exe	56
PID 1704 wrote to memory of 2740	1704	Transferencia.exe	56
PID 1704 wrote to memory of 1644	1704	Transferencia.exe	58
PID 1704 wrote to memory of 1644	1704	Transferencia.exe	58
PID 1704 wrote to memory of 1644	1704	Transferencia.exe	58
PID 1704 wrote to memory of 1644	1704	Transferencia.exe	58

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
PID:1192
- C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
  "C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x75^38"
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4E^38"
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:2844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x71^38"
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:1584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x56^38"
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:2532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:2568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1036
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:1788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:356
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:292
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x6D^38"
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x74^38"
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x68^38"
    3⤵
    PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x6A^38"
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x70^38"
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:2668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x67^38"
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x63^38"
    3⤵
    PID:1916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:2840
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0B^38"
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:948
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x10^38"
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2120
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5E^38"
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x10^38"
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x56^38"
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4D^38"
    3⤵
    PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x17^38"
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1F^38"
    3⤵
    PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4B^38"
    3⤵
    PID:3012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x50^38"
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x52^38"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x08^38"
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x79^38"
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x13^38"
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2932
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x11^38"
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x10^38"
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1E^38"
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x53^38"
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x55^38"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x43^38"
    3⤵
    PID:2996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:3068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x15^38"
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x14^38"
    3⤵
    PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x1C^38"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x65^38"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x47^38"
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:2832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4A^38"
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x71^38"
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x48^38"
    3⤵
    PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x42^38"
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:2056
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x51^38"
    3⤵
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x76^38"
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x49^38"
    3⤵
    PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x45^38"
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x67^38"
    3⤵
    PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0E^38"
    3⤵
    PID:272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:1508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x54^38"
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x12^38"
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0A^38"
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x4F^38"
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x06^38"
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x16^38"
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x0F^38"
    3⤵
    PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c set /a "0x5F^38"
    3⤵
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Transferencia.exe
    "C:\Users\Admin\AppData\Local\Temp\Transferencia.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3040
- C:\Windows\SysWOW64\dvdplay.exe
  "C:\Windows\SysWOW64\dvdplay.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nrh4jlhx.zip

Filesize
557KB

MD5
d113a47c6ac162a76d78c817aeb57755

SHA1
f301cea25c2032dd67ffbd21242b209f0ee70ee2

SHA256
bae32df8fa24a3e55bcc1591e09918259173f870090e2ae775509edb8b893eb4

SHA512
ba64e248ee75fa43cae60c1e0815c512f89eabc140b35aa696d428a3f5d328db04981c0f500b78211bbfd9087ba678328c8ad63ac51249062900693a1d399178

Download Submit
\Users\Admin\AppData\Local\Temp\nst2702.tmp\System.dll

Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
\Users\Admin\AppData\Local\Temp\nst2702.tmp\nsExec.dll

Filesize
6KB

MD5
4a2f4fe4a3ad1de56ee6bf7dd4923963

SHA1
7cc68b94448c964fd99904e5784b059aed4d5daa

SHA256
89b1e6509a1b45b32933e9d785a9c8c5b9ce7c616e1112dcf7fc3fa5ca27ebde

SHA512
4b6bbe75beafae9a29932ff5ddd3940aadfae62c157836e6cdab755955782dd5354d5eb389b4b8c16bf59f4ce7a099a0161d915c1cf2968f28e195dc8e3997ea

Download Submit
memory/1192-936-0x00000000042B0000-0x0000000004354000-memory.dmp

Filesize
656KB

Download
memory/1368-932-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/1368-972-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/1368-973-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1368-935-0x00000000000D0000-0x000000000010F000-memory.dmp

Filesize
252KB

Download
memory/3040-922-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/3040-926-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/3040-933-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/3040-925-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/3040-924-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/3040-923-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/3040-921-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/3040-899-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download