Resubmissions
03/07/2024, 16:09
240703-tl9n3ayepb03/07/2024, 16:04
240703-thygmaycpc1001/07/2024, 18:12
240701-ws6xvswbkj1001/07/2024, 18:03
240701-wm5sls1gka1001/07/2024, 18:03
240701-wm39sa1gjf1001/07/2024, 18:03
240701-wm2e7avhkj1001/07/2024, 18:03
240701-wmzxcs1fre1001/07/2024, 18:02
240701-wmzats1frc1001/07/2024, 18:02
240701-wmvbwa1fqh1022/11/2023, 17:02
231122-vkac9adg6410Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
03/07/2024, 16:04
General
- Target 31.exe
- Size 12.5MB
- Sample240703-thygmaycpc
- SHA256 7570a7a6830ade05dcf862d5862f12f12445dbd3c0ad7433d90872849e11c267
Malware Config
Extracted
-
formbook
-
4.0
-
w9z
-
crazzysex.com
-
hanferd.com
-
gteesrd.com
-
bayfrontbabyplace.com
-
jicuiquan.net
-
relationshiplink.net
-
ohchacyberphoto.com
-
kauegimenes.com
-
powerful-seldom.com
-
ketotoken.com
-
make-money-online-success.com
-
redgoldcollection.com
-
hannan-football.com
-
hamptondc.com
-
vllii.com
-
aa8520.com
-
platform35markethall.com
-
larozeimmo.com
-
oligopoly.net
-
llhak.info
Extracted
-
gozi
-
build
300869
-
exe_type
loader
Extracted
-
gozi
-
86920224
-
https://sibelikinciel.xyz
-
build
300869
-
exe_type
loader
-
server_id
12
-
url_path
index.htm
Extracted
-
danabot
-
92.204.160.54
-
2.56.213.179
-
45.153.186.47
-
93.115.21.29
-
185.45.193.50
-
193.34.166.247
Extracted
-
formbook
-
4.1
-
i0qi
-
mytakeawaybox.com
-
goutaihuo.com
-
kuzey.site
-
uppertenpiercings.amsterdam
-
honeygrandpa.com
-
jenniferabramslaw.com
-
ncarian.com
-
heavilymeditatedhouston.com
-
gsbjyzx.com
-
akisanblog.com
-
taoyuanreed.com
-
jasperrvservices.com
-
yabbanet.com
-
myhealthfuldiet.com
-
flipdigitalcoins.com
-
toes.photos
-
shoottillyoumiss.com
-
maserental.com
-
smarteacher.net
-
hamdimagdeco.com
Extracted
-
formbook
-
4.1
-
app
-
niresandcard.com
-
bonusscommesseonline.com
-
mezhyhirya.com
-
paklfz.com
-
bespokewomensuits.com
-
smarteralarm.info
-
munespansiyon.com
-
pmtradehouse.com
-
hotmobile-uk.com
-
ntdao.com
-
zohariaz.com
-
www145123.com
-
oceanstateofstyle.com
-
palermofelicissima.info
-
yourkinas.com
-
pthwheel.net
-
vfmagent.com
-
xn--3v0bw66b.com
-
comsystematrisk.win
-
on9.party
Signatures
- AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
- Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
- Danabot x86 payload 1 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
- Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- AgentTesla payload 8 IoCs
- CryptOne packer 2 IoCs
Detects CryptOne packer defined in NCC blogpost.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Formbook payload 4 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- ReZer0 packer 3 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
- Renames multiple (56) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 18 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Adds Run key to start application 2 TTPs 3 IoCs
- Drops desktop.ini file(s) 4 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies registry class 1 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\31.exe"C:\Users\Admin\AppData\Local\Temp\31.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6AC0.tmp\6AC1.tmp\6AC2.bat C:\Users\Admin\AppData\Local\Temp\31.exe"3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre-1.8\bin\javaw.exe"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\1.jar"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeC:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M5⤵
- Modifies file permissions
-
-
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\2.exeC:\Users\Admin\AppData\Roaming\2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe4⤵
- Checks QEMU agent file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\3.exeC:\Users\Admin\AppData\Roaming\3.exe5⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
C:\Users\Admin\AppData\Roaming\4.exeC:\Users\Admin\AppData\Roaming\4.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\4.dll f1 C:\Users\Admin\AppData\Roaming\4.exe@25485⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\4.dll,f06⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 5005⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\5.exeC:\Users\Admin\AppData\Roaming\5.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\6.exeC:\Users\Admin\AppData\Roaming\6.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\7.exeC:\Users\Admin\AppData\Roaming\7.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\7.exeC:\Users\Admin\AppData\Roaming\7.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\8.exeC:\Users\Admin\AppData\Roaming\8.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v feeed /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\feeed.exe"6⤵
- Adds Run key to start application
-
-
-
C:\Users\Admin\AppData\Roaming\feeed.exe"C:\Users\Admin\AppData\Roaming\feeed.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\9.exeC:\Users\Admin\AppData\Roaming\9.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wWTxgR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF889.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\9.exe"{path}"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\10.exeC:\Users\Admin\AppData\Roaming\10.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\11.exeC:\Users\Admin\AppData\Roaming\11.exe4⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Maps connected drives based on registry
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnLKhBlJfQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA316.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\11.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\11.exe"C:\Users\Admin\AppData\Roaming\11.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\13.exeC:\Users\Admin\AppData\Roaming\13.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"C:\Users\Admin\AppData\Local\Temp\Trainbandanigon6\Styltendeschris.exe"7⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\14.exeC:\Users\Admin\AppData\Roaming\14.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\15.exeC:\Users\Admin\AppData\Roaming\15.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\16.exeC:\Users\Admin\AppData\Roaming\16.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\17.exeC:\Users\Admin\AppData\Roaming\17.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 6125⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\18.exeC:\Users\Admin\AppData\Roaming\18.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe4⤵
-
C:\Users\Admin\AppData\Roaming\19.exeC:\Users\Admin\AppData\Roaming\19.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe4⤵
-
C:\Users\Admin\AppData\Roaming\20.exeC:\Users\Admin\AppData\Roaming\20.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\21.exeC:\Users\Admin\AppData\Roaming\21.exe4⤵
-
C:\Users\Admin\AppData\Roaming\21.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\22.exeC:\Users\Admin\AppData\Roaming\22.exe4⤵
-
-
C:\Users\Admin\AppData\Roaming\23.exeC:\Users\Admin\AppData\Roaming\23.exe4⤵
-
-
C:\Users\Admin\AppData\Roaming\24.exeC:\Users\Admin\AppData\Roaming\24.exe4⤵
-
C:\Users\Admin\AppData\Roaming\24.exe"{path}"5⤵
-
-
C:\Users\Admin\AppData\Roaming\24.exe"{path}"5⤵
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profile6⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\25.exeC:\Users\Admin\AppData\Roaming\25.exe4⤵
-
-
C:\Users\Admin\AppData\Roaming\26.exeC:\Users\Admin\AppData\Roaming\26.exe4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qATVyEXYNcqQZF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6898.tmp"5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\26.exe"{path}"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe4⤵
-
C:\Users\Admin\AppData\Roaming\27.exeC:\Users\Admin\AppData\Roaming\27.exe /C5⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yxrkfi\lbrnb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Yxrkfi\lbrnb.exe5⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Yxrkfi\lbrnb.exeC:\Users\Admin\AppData\Roaming\Microsoft\Yxrkfi\lbrnb.exe /C6⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn vtjmxojefy /tr "\"C:\Users\Admin\AppData\Roaming\27.exe\" /I vtjmxojefy" /SC ONCE /Z /ST 16:10 /ET 16:225⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\28.exeC:\Users\Admin\AppData\Roaming\28.exe4⤵
-
C:\Users\Admin\AppData\Roaming\28.exeC:\Users\Admin\AppData\Roaming\28.exe5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\29.exeC:\Users\Admin\AppData\Roaming\29.exe4⤵
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Roaming\29.dll f1 C:\Users\Admin\AppData\Roaming\29.exe@69445⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Roaming\29.dll,f06⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6944 -s 4725⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Roaming\30.exeC:\Users\Admin\AppData\Roaming\30.exe4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\\\\Windows\\\\Microsoft.NET\\\\Framework\\\\v4.0.30319\\\\MSBuild.exe"5⤵
-
C:\Windows\SysWOW64\REG.exeREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f6⤵
- Modifies registry key
-
-
-
-
C:\Users\Admin\AppData\Roaming\31.exeC:\Users\Admin\AppData\Roaming\31.exe4⤵
-
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\2.exe"3⤵
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\18.exe"3⤵
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Roaming\11.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2548 -ip 25481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5460 -ip 54601⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5256 CREDAT:17410 /prefetch:22⤵
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5256 CREDAT:17418 /prefetch:22⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6944 -ip 69441⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Indicator Removal
2File Deletion
2Modify Registry
2Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
appvcleaner.exe.id-E72AE53E.[[email protected]].BOMBO
3903daac9bc4a3b7.timestamp
ver3280.tmp
6AC2.bat
tmpA316.tmp
1.jar
10.exe
11.exe
12.exe
13.exe
14.exe
15.exe
16.exe
17.exe
18.exe
19.exe
2.exe
20.exe
21.exe
22.exe
23.exe
24.exe
25.exe
26.exe
3.exe
4.dll
4.exe
5.exe
6.exe
7.exe
8.exe
9.exe
J-9logrv.ini
CachedImage_1280_720_POS4.jpg
lbrnb.exe
index.html
license
license
.travis.yml
GOVERNANCE.md
LICENSE
README.md
2015-01-30.md
duplex-browser.js
duplex.js
_stream_duplex.js
_stream_passthrough.js
_stream_readable.js
_stream_transform.js
_stream_writable.js
BufferList.js
destroy.js
stream-browser.js
stream.js
passthrough.js
readable-browser.js
readable.js
transform.js
writable-browser.js
writable.js
.travis.yml
LICENSE
README.md
string_decoder.js
LICENSE
.npmignore
Makefile
LICENSE
PULL_REQUEST_TEMPLATE
.travis.yml
appveyor.yml
LICENSE.md
LICENSE
LICENSE
LICENSE
LICENSE
README.md
LICENSE
.editorconfig
LICENSE
LICENSE
index.js
LICENSE
LICENSE
LICENSE
.travis.yml
LICENSE
LICENSE
.editorconfig
README.md
index.js
README.md
index.coffee
index.js
LICENSE
LICENSE
.npmignore
.npmignore
tag.js
.travis.yml
LICENSE.APACHE2
LICENSE.MIT
LICENSE
index.d.ts
LICENSE.txt
LICENSE
LICENSE
index.js
readme.md
node-gyp
node-gyp.cmd
npm
npm.cmd
npx
npx.cmd
network-icon-f659855f70bb0e12addd96250807c241.svg
is-windows.js
History.md
README.md
index.js
LICENSE
LICENSE
defer.js
en.js
LICENSE
index.js
readme.md
index.js
readme.md
License
LICENSE
license
LICENSE
README.md
license.md
LICENSE
.travis.yml
.npmignore
.travis.yml
es6.js
isPrimitive.js
es6-promise.auto.js
es6-promise.auto.map
es6-promise.map
stdio.js
buffer-stream.js
index.js
readme.md
LICENSE
LICENSE
.travis.yml
LICENSE
LICENSE.md
LICENSE
LICENSE
.npmignore
LICENSE
.jscs.json
.travis.yml
.jscs.json
component.json
nb.json
.travis.yml
parse.js
readme.markdown
prettify.css
prettify.js
sort-arrow-sprite.png
README.md
index.js
License
equation.gif
dns.js
stop.js
index.js
license
LICENSE
LICENSE
CHANGELOG.md
LICENSE
install_tools.bat
node_etw_provider.man
.licensee.json
.mailmap
.npmignore
.travis.yml
AUTHORS
CHANGELOG.md
CONTRIBUTING.md
Makefile
npm-cli.js
npx-cli.js
CHANGELOG-1.md
CHANGELOG-2.md
CHANGELOG-3.md
CHANGELOG-4.md
CHANGELOG-5.md
configure
LICENSE
npm-access.md
npm-adduser.md
npm-audit.md
npm-bin.md
npm-bugs.md
npm-build.md
npm-bundle.md
npm-cache.md
npm-ci.md
npm-completion.md
npm-config.md
npm-dedupe.md
npm-deprecate.md
npm-dist-tag.md
npm-docs.md
npm-doctor.md
npm-edit.md
npm-explore.md
npm-fund.md
npm-help-search.md
npm-help.md
npm-hook.md
npm-init.md
npm-install-ci-test.md
npm-install-test.md
npm-install.md
npm-link.md
npm-logout.md
npm-ls.md
npm-org.md
npm-outdated.md
npm-owner.md
npm-pack.md
npm-ping.md
npm-prefix.md
npm-profile.md
npm-prune.md
npm-publish.md
npm-rebuild.md
npm-repo.md
npm-restart.md
npm-root.md
npm-run-script.md
npm-search.md
npm-shrinkwrap.md
npm-star.md
npm-stars.md
npm-start.md
npm-stop.md
npm-team.md
npm-test.md
npm-token.md
npm-uninstall.md
npm-unpublish.md
npm-update.md
npm-version.md
npm-view.md
npm-whoami.md
npm.md
folders.md
install.md
npmrc.md
package-json.md
package-lock-json.md
package-locks.md
shrinkwrap-json.md
config.md
developers.md
disputes.md
orgs.md
registry.md
removal.md
scope.md
scripts.md
semver.md
gatsby-browser.js
gatsby-config.js
gatsby-node.js
gatsby-ssr.js
package-lock.json
package.json
QldKNThLqRwH-OJ1UHjlKGlZ5q4.woff
QldKNThLqRwH-OJ1UHjlKGlZ5qg.woff2
QldXNThLqRwH-OJ1UHjlKGHiw71p5_o.woff
test-icon.svg
up-carrot.svg
writable.js
link.js
logout.js
ls.js
npm.js
org.js
outdated.js
owner.js
pack.js
ping.js
prefix.js
profile.js
prune.js
publish.js
rebuild.js
repo.js
restart.js
root.js
run-script.js
all-package-metadata.js
all-package-search.js
format-package-stream.js
package-filter.js
set.js
shrinkwrap.js
star.js
stars.js
start.js
stop.js
substack.js
team.js
test.js
token.js
unbuild.js
uninstall.js
unpublish.js
update.js
ansi-trim.js
cache-file.js
child-path.js
completion.sh
file-completion.js
installed-deep.js
installed-shallow.js
correct-mkdir.js
deep-sort-object.js
depr-check.js
did-you-mean.js
error-handler.js
error-message.js
escape-arg.js
escape-exec-path.js
funding.js
gently-rm.js
git.js
gunzip-maybe.js
is-registry.js
is-windows-bash.js
is-windows-shell.js
lifecycle-cmd.js
lifecycle.js
link.js
locker.js
metrics-launch.js
metrics.js
module-name.js
move.js
no-progress-while-running.js
open-url.js
otplease.js
output.js
package-id.js
parse-json.js
perf.js
pick-manifest-from-registry-metadata.js
pulse-till-done.js
read-local-package.js
read-user-info.js
save-stack.js
spawn.js
temp-filename.js
umask.js
unix-format-path.js
unsupported.js
usage.js
warn-deprecated.js
version.js
view.js
visnup.js
whoami.js
xmas.js
make.bat
npm-README.1
npm-access.1
npm-adduser.1
npm-audit.1
npm-bin.1
npm-bugs.1
npm-build.1
npm-bundle.1
npm-cache.1
npm-ci.1
npm-completion.1
npm-config.1
npm-dedupe.1
npm-deprecate.1
npm-dist-tag.1
npm-docs.1
npm-doctor.1
npm-edit.1
npm-explore.1
npm-fund.1
npm-help-search.1
npm-help.1
npm-hook.1
npm-init.1
npm-install-ci-test.1
npm-install-test.1
npm-install.1
npm-link.1
npm-logout.1
npm-ls.1
npm-org.1
npm-outdated.1
npm-owner.1
npm-pack.1
npm-ping.1
npm-prefix.1
npm-profile.1
npm-prune.1
npm-publish.1
npm-rebuild.1
npm-repo.1
npm-restart.1
npm-root.1
npm-run-script.1
npm-search.1
npm-shrinkwrap.1
npm-star.1
npm-stars.1
npm-start.1
npm-stop.1
npm-team.1
npm-test.1
npm-token.1
npm-uninstall.1
npm-unpublish.1
npm-update.1
npm-version.1
npm-view.1
npm-whoami.1
npm.1
npx.1
folders.5
install.5
npmrc.5
package-json.5
package-lock-json.5
package-locks.5
shrinkwrap-json.5
config.7
developers.7
disputes.7
orgs.7
registry.7
removal.7
scope.7
scripts.7
semver.7
LICENSE
README.md
abbrev.js
package.json
.travis.yml
index.d.ts
package.json
patch-core.js
History.md
README.md
browser.js
index.d.ts
index.js
_http_agent.js
agent.js
https_agent.js
package.json
.tonic_example.js
LICENSE
README.md
ajv.bundle.js
ajv.min.js
ajv.min.js.map
nodent.min.js
regenerator.min.js
$data.js
ajv.d.ts
ajv.js
cache.js
_rules.js
async.js
equal.js
error_classes.js
formats.js
index.js
resolve.js
rules.js
schema_obj.js
ucs2length.js
util.js
_limit.jst
_limitItems.jst
_limitLength.jst
_limitProperties.jst
allOf.jst
anyOf.jst
coerce.def
const.jst
contains.jst
custom.jst
defaults.def
definitions.def
dependencies.jst
enum.jst
errors.def
format.jst
items.jst
missing.def
multipleOf.jst
not.jst
oneOf.jst
pattern.jst
properties.jst
propertyNames.jst
ref.jst
required.jst
uniqueItems.jst
validate.jst
README.md
_limit.js
_limitItems.js
_limitLength.js
_limitProperties.js
allOf.js
anyOf.js
const.js
contains.js
custom.js
dependencies.js
enum.js
format.js
items.js
multipleOf.js
not.js
oneOf.js
pattern.js
properties.js
propertyNames.js
ref.js
required.js
uniqueItems.js
validate.js
keyword.js
patternGroups.js
$data.json
json-schema-draft-04.json
json-schema-draft-06.json
json-schema-v5.json
package.json
.eslintrc.yml
bundle.js
compile-dots.js
info
prepare-tests
travis-gh-pages
CHANGELOG.md
README.md
index.js
package.json
index.js
package.json
readme.md
index.js
package.json
readme.md
README.md
ansicolors.js
package.json
README.md
ansistyles.js
package.json
CHANGELOG.md
index.js
package.json
.travis.yml
README.markdown
beep.js
multi_line.js
index.js
package.json
CHANGES.md
LICENSE
README.md
index.js
package.json
package.json
package.json
tracker-base.js
tracker-group.js
tracker-stream.js
tracker.js
CHANGES.md
LICENSE.md
README.md
asap.js
browser-asap.js
browser-raw.js
package.json
raw.js
LICENSE
README.md
errors.js
index.js
reader.js
types.js
writer.js
index.js
package.json
AUTHORS
CHANGES.md
README.md
assert.js
package.json
LICENSE
bench.js
index.js
abort.js
async.js
iterate.js
readable_asynckit.js
readable_parallel.js
readable_serial.js
readable_serial_ordered.js
state.js
streamify.js
terminator.js
package.json
package.json
LICENSE
hasEmptyArgumentBug.js
index.js
.jscs.json
.nycrc
CHANGELOG.md
README.md
package.json
index.js
README.md
har.json
header.json
index.js
log.json
page.json
pageTimings.json
postData.json
query.json
request.json
response.json
timings.json
package.json
README.md
async.js
error.js
promise.js
package.json
index.js
README.md
package.json
LICENSE-MIT
README.md
package.json
index.js
CHANGELOG.md
LICENSE
README.md
git-host-info.js
git-host.js
index.js
package.json
README.md
index.js
package.json
.travis.yml
History.md
README.md
index.js
package.json
.dir-locals.el
.npmignore
CHANGES.md
README.md
http_signing.md
index.js
parser.js
signer.js
utils.js
verify.js
package.json
.editorconfig
.eslintrc.js
History.md
README.md
index.d.ts
index.js
package.json
History.md
LICENSE
README.md
index.js
package.json
.travis.yml
Changelog.md
LICENSE
README.md
dbcs-codec.js
dbcs-data.js
index.js
internal.js
sbcs-codec.js
sbcs-data-generated.js
sbcs-data.js
big5-added.json
cp936.json
cp949.json
cp950.json
eucjp.json
gb18030-ranges.json
gbk-added.json
shiftjis.json
utf16.js
utf7.js
bom-handling.js
extend-node.js
index.d.ts
index.js
streams.js
package.json
README.md
iferr.js
package.json
README.md
index.js
package.json
index.js
package.json
readme.md
README.md
imurmurhash.js
imurmurhash.min.js
package.json
README.md
index.js
package.json
README.md
inflight.js
package.json
inherits.js
inherits_browser.js
package.json
README.md
nodevars.bat
memory/1224-80-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1224-185-0x0000000000400000-0x000000000042D000-memory.dmp
memory/1548-186-0x0000000000CA0000-0x0000000000CB6000-memory.dmp
memory/1556-7989-0x0000000002120000-0x000000000238B000-memory.dmp
memory/2164-126-0x0000000005EE0000-0x0000000006484000-memory.dmp
memory/2164-128-0x0000000005A30000-0x0000000005AC2000-memory.dmp
memory/2164-127-0x00000000030E0000-0x00000000030E8000-memory.dmp
memory/2164-117-0x0000000000FC0000-0x000000000106C000-memory.dmp
memory/2164-122-0x00000000030D0000-0x00000000030E4000-memory.dmp
memory/2164-155-0x0000000005B90000-0x0000000005B98000-memory.dmp
memory/2164-154-0x0000000005E80000-0x0000000005EC4000-memory.dmp
memory/2164-153-0x0000000005B80000-0x0000000005B88000-memory.dmp
memory/2216-101-0x000001824EB50000-0x000001824EB51000-memory.dmp
memory/2216-249-0x000001824EB50000-0x000001824EB51000-memory.dmp
memory/2216-269-0x000001824EB50000-0x000001824EB51000-memory.dmp
memory/2216-158-0x000001824EB50000-0x000001824EB51000-memory.dmp
memory/2308-11209-0x0000000000400000-0x000000000055D000-memory.dmp
memory/2308-281-0x0000000000400000-0x000000000055D000-memory.dmp
memory/2548-9881-0x0000000000400000-0x000000000300E000-memory.dmp
memory/2828-82-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/3544-6412-0x0000000008060000-0x0000000008116000-memory.dmp
memory/3544-9626-0x0000000008060000-0x0000000008116000-memory.dmp
memory/3544-6127-0x0000000008060000-0x0000000008116000-memory.dmp
memory/4716-9685-0x0000000005360000-0x00000000053C2000-memory.dmp
memory/4716-9689-0x00000000071D0000-0x0000000007226000-memory.dmp
memory/4716-9681-0x0000000000AC0000-0x0000000000B58000-memory.dmp
memory/4828-142-0x00000000006C0000-0x00000000006D0000-memory.dmp
memory/4828-9883-0x0000000000400000-0x0000000000439000-memory.dmp
memory/4904-217-0x00000000075B0000-0x000000000764C000-memory.dmp
memory/4904-216-0x00000000074B0000-0x0000000007508000-memory.dmp
memory/4904-161-0x0000000004A10000-0x0000000004A1A000-memory.dmp
memory/4904-141-0x0000000000090000-0x000000000014E000-memory.dmp
memory/4904-206-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
memory/4924-9662-0x0000000000400000-0x0000000000407000-memory.dmp
memory/5280-9670-0x00000000009E0000-0x0000000000A4A000-memory.dmp
memory/5280-9677-0x0000000008090000-0x00000000080E8000-memory.dmp
memory/5456-14814-0x0000000000400000-0x0000000000452000-memory.dmp
memory/5456-21311-0x00000000059B0000-0x00000000059C8000-memory.dmp
memory/6024-6393-0x0000000005900000-0x000000000592D000-memory.dmp
memory/6024-5771-0x0000000005700000-0x0000000005752000-memory.dmp
memory/6024-4764-0x0000000000E00000-0x0000000000E6E000-memory.dmp
memory/6024-5781-0x0000000005750000-0x0000000005790000-memory.dmp
memory/6072-9627-0x00000000003D0000-0x00000000003E2000-memory.dmp
memory/6072-9632-0x00000000003D0000-0x00000000003E2000-memory.dmp
memory/6072-9630-0x00000000003D0000-0x00000000003E2000-memory.dmp
memory/6176-8425-0x0000000000400000-0x000000000042D000-memory.dmp
memory/6352-9656-0x0000000000400000-0x000000000044E000-memory.dmp
memory/6588-24539-0x0000000000400000-0x0000000000452000-memory.dmp
memory/8156-9655-0x0000000000020000-0x00000000001A4000-memory.dmp
memory/8156-9671-0x00000000051D0000-0x0000000005236000-memory.dmp
memory/8156-9668-0x0000000004A50000-0x0000000004A56000-memory.dmp
memory/8156-9667-0x0000000004CA0000-0x0000000004E3A000-memory.dmp
memory/8156-9658-0x00000000049A0000-0x00000000049A6000-memory.dmp
memory/8496-37895-0x0000000000400000-0x0000000000452000-memory.dmp
memory/11840-19852-0x0000000001560000-0x0000000001574000-memory.dmp
memory/11840-30214-0x0000000006C50000-0x0000000006C72000-memory.dmp
memory/11924-40078-0x0000000000700000-0x0000000000752000-memory.dmp
memory/12620-27234-0x0000000000400000-0x0000000000450000-memory.dmp