Overview

overview

10

Static

static

3

FileApp.exe

windows7-x64

10

FileApp.exe

windows10-1703-x64

6

FileApp.exe

windows10-2004-x64

6

Resubmissions

03-11-2024 11:03

241103-m5srbs1qfs 5

03-09-2024 16:16

240903-tqvqpssbrg 10

03-09-2024 15:55

240903-tdaj1a1anq 6

Analysis

  • max time kernel
    264s
  • max time network
    304s
  • platform
    windows7_x64
  • resource
    win7-20240903-es
  • resource tags

    arch:x64arch:x86image:win7-20240903-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    03-09-2024 16:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FileApp.exe

  • Size

    739.0MB

  • MD5

    a6f1c5f8ff75ca1e78f55e1a05b44b39

  • SHA1

    b3a15feeee3c80425027f0f19901a8475f64f014

  • SHA256

    7357bdbe52a049e175f5005711fde9fbddde36ad6419006f0c3cf13ed1cb70e3

  • SHA512

    a3503a34bee2e531e7d0175a5dc99d7d2a652bbb53d91a9ac6534cbffe1d907f04384ddc48c2bd16e77435d8b0b97118145f3d2e7c9512f2005c9ae900814c68

  • SSDEEP

    98304:GMzgISSXaYGFQime2hKRculpYX8GRlwc2h00SQDFaFue:G4SGaRFb3TlpYlwcODFaI

Score
10/10
djvuredlinestealctofseelevalogsdiller cloud (tg: @logsdillabot)credential_accessdiscoveryevasionexecutioninfostealerpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

147.45.47.36:30035

Extracted

Family

stealc

Botnet

leva

C2

http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 5 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 21 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 24 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 9 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Launches sc.exe 7 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FileApp.exe
    "C:\Users\Admin\AppData\Local\Temp\FileApp.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe
        C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        PID:2368
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1204
      • C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe
        C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        PID:2772
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:984
      • C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe
        C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        PID:2880
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:1800
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:848
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminCAEHDBAAEC.exe"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1340
              • C:\Users\AdminCAEHDBAAEC.exe
                "C:\Users\AdminCAEHDBAAEC.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:1944
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  7⤵
                    PID:1560
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    PID:2700
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDBFCBGCGIJ.exe"
                5⤵
                  PID:2528
                  • C:\Users\AdminDBFCBGCGIJ.exe
                    "C:\Users\AdminDBFCBGCGIJ.exe"
                    6⤵
                      PID:2504
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        7⤵
                          PID:2044
                • C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
                  C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
                  3⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2744
                  • C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp" /SL5="$7011C,3332875,54272,C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe"
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:2648
                • C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
                  C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:2768
                  • C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
                    C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1848
                    • C:\Windows\SysWOW64\icacls.exe
                      icacls "C:\Users\Admin\AppData\Local\22726f0b-26f7-4321-b2cc-27745ea16ef3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                      5⤵
                      • Modifies file permissions
                      • System Location Discovery: System Language Discovery
                      PID:2844
                    • C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
                      "C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe" --Admin IsNotAutoStart IsNotTask
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:2640
                      • C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
                        "C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe" --Admin IsNotAutoStart IsNotTask
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2908
                • C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe
                  C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2676
                • C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe
                  C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2796
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jzlukfpb\
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:372
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nlvwyuxd.exe" C:\Windows\SysWOW64\jzlukfpb\
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2012
                  • C:\Windows\SysWOW64\sc.exe
                    "C:\Windows\System32\sc.exe" create jzlukfpb binPath= "C:\Windows\SysWOW64\jzlukfpb\nlvwyuxd.exe /d\"C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe\"" type= own start= auto DisplayName= "wifi support"
                    4⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:1144
                  • C:\Windows\SysWOW64\sc.exe
                    "C:\Windows\System32\sc.exe" description jzlukfpb "wifi internet conection"
                    4⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:2044
                  • C:\Windows\SysWOW64\sc.exe
                    "C:\Windows\System32\sc.exe" start jzlukfpb
                    4⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:1972
                  • C:\Windows\SysWOW64\netsh.exe
                    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                    4⤵
                    • Modifies Windows Firewall
                    • Event Triggered Execution: Netsh Helper DLL
                    • System Location Discovery: System Language Discovery
                    PID:2800
                • C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe
                  C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2188
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                    4⤵
                    • Power Settings
                    PID:624
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                    4⤵
                    • Power Settings
                    PID:1280
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                    4⤵
                    • Power Settings
                    PID:1732
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    4⤵
                    • Power Settings
                    PID:2264
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe delete "VIFLJRPW"
                    4⤵
                    • Launches sc.exe
                    PID:2420
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe create "VIFLJRPW" binpath= "C:\ProgramData\xprfjygruytr\etzpikspwykg.exe" start= "auto"
                    4⤵
                    • Launches sc.exe
                    PID:592
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop eventlog
                    4⤵
                    • Launches sc.exe
                    PID:1724
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe start "VIFLJRPW"
                    4⤵
                    • Launches sc.exe
                    PID:2740
                • C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
                  C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1188
                  • C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
                    "C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:2984
                  • C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
                    "C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:708
                  • C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
                    "C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:1504
                  • C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
                    "C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:612
                  • C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
                    "C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:2328
                • C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe
                  C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:1724
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    4⤵
                      PID:2976
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      4⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2972
              • C:\Windows\SysWOW64\jzlukfpb\nlvwyuxd.exe
                C:\Windows\SysWOW64\jzlukfpb\nlvwyuxd.exe /d"C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:1820
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Sets service image path in registry
                  • System Location Discovery: System Language Discovery
                  PID:688
              • C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
                C:\ProgramData\xprfjygruytr\etzpikspwykg.exe
                1⤵
                  PID:612
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                    2⤵
                    • Power Settings
                    PID:1916
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                    2⤵
                    • Power Settings
                    PID:2484
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                    2⤵
                    • Power Settings
                    PID:2500
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    2⤵
                    • Power Settings
                    PID:2896
                  • C:\Windows\system32\conhost.exe
                    C:\Windows\system32\conhost.exe
                    2⤵
                      PID:2900
                    • C:\Windows\system32\svchost.exe
                      svchost.exe
                      2⤵
                        PID:2476

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    System Services

                    2
                    T1569

                    Service Execution

                    2
                    T1569.002

                    Persistence

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Create or Modify System Process

                    3
                    T1543

                    Windows Service

                    3
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Power Settings

                    1
                    T1653

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    2
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Create or Modify System Process

                    3
                    T1543

                    Windows Service

                    3
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Defense Evasion

                    File and Directory Permissions Modification

                    1
                    T1222

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Modify Registry

                    3
                    T1112

                    Subvert Trust Controls

                    1
                    T1553

                    Install Root Certificate

                    1
                    T1553.004

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    4
                    T1552

                    Credentials In Files

                    4
                    T1552.001

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Query Registry

                    6
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    3
                    T1005

                    Command and Control

                    Web Service

                    1
                    T1102

                    Exfiltration

                    Impact

                    Service Stop

                    1
                    T1489

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\FCGIJKJJKEBG\GHJDHD
                      Filesize

                      92KB

                      MD5

                      2cd7a684788f438d7a7ae3946df2e26f

                      SHA1

                      3e5a60f38395f3c10d9243ba696468d2bb698a14

                      SHA256

                      2ebed8dd3531958e857c87ddbf46376b8a10ea2f364d2399d9fcc604da0bee1d

                      SHA512

                      0fec4b36e2173d1ad5eca880e1be1d0c7093d459aeb612d371e4ac92fbeaea55beb36e9228d36d57fe1851bd4d57b26dd5b8edb4620fb17b91441e840669c7d1

                      Download Submit

                    • C:\ProgramData\FCGIJKJJKEBG\JDGCFB
                      Filesize

                      6KB

                      MD5

                      267d46a0d5fc4c0fbe1ac157d62955c3

                      SHA1

                      8b5e6f3a399e18c27dd84fafa2d0ad1f6e0c55b0

                      SHA256

                      4fec4b334e7835087b88c216478e031aca0e2d70ead95c0f7a7037eaa5594eed

                      SHA512

                      0cd1accf3970e5f509a08342aafb886cdec3a867d11e0d4770b69b765a70da02e5ee6691247e4cc734ac0de9738a7cf51a0bb9112e80e9e8cd45da7e7431c0f2

                      Download Submit

                    • C:\ProgramData\freebl3.dll
                      Filesize

                      669KB

                      MD5

                      550686c0ee48c386dfcb40199bd076ac

                      SHA1

                      ee5134da4d3efcb466081fb6197be5e12a5b22ab

                      SHA256

                      edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

                      SHA512

                      0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

                      Download Submit

                    • C:\ProgramData\msvcp140.dll
                      Filesize

                      439KB

                      MD5

                      5ff1fca37c466d6723ec67be93b51442

                      SHA1

                      34cc4e158092083b13d67d6d2bc9e57b798a303b

                      SHA256

                      5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

                      SHA512

                      4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

                      Download Submit

                    • C:\ProgramData\softokn3.dll
                      Filesize

                      251KB

                      MD5

                      4e52d739c324db8225bd9ab2695f262f

                      SHA1

                      71c3da43dc5a0d2a1941e874a6d015a071783889

                      SHA256

                      74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

                      SHA512

                      2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

                      Download Submit

                    • C:\ProgramData\vcruntime140.dll
                      Filesize

                      78KB

                      MD5

                      a37ee36b536409056a86f50e67777dd7

                      SHA1

                      1cafa159292aa736fc595fc04e16325b27cd6750

                      SHA256

                      8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

                      SHA512

                      3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                      Filesize

                      1KB

                      MD5

                      7fb5fa1534dcf77f2125b2403b30a0ee

                      SHA1

                      365d96812a69ac0a4611ea4b70a3f306576cc3ea

                      SHA256

                      33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

                      SHA512

                      a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                      Filesize

                      436B

                      MD5

                      971c514f84bba0785f80aa1c23edfd79

                      SHA1

                      732acea710a87530c6b08ecdf32a110d254a54c8

                      SHA256

                      f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                      SHA512

                      43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                      Filesize

                      174B

                      MD5

                      dd776116027bf05105d0b67762a4b1fd

                      SHA1

                      83ba015fca8305a4850fc92d1e510e13451c8176

                      SHA256

                      cce25db7c21eecfaf30081e72c913ffb4e116a0a3ee7e98b95bea365131cd94f

                      SHA512

                      82a5b72f659429413e8b2c85909703d6ed1c589da00eb19db9ede116cd65a83dfd1e6fb11462e79c3bd11fe5a626e8d2c3f074384fec296fe6d21e78f6e2a1ec

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                      Filesize

                      170B

                      MD5

                      0c7ab8bca7a846177c305f8a839ae6be

                      SHA1

                      5d331608f4879f0c31b75b39a846303e8b2ca9bf

                      SHA256

                      5c0ef93db3944a4d8b7e47a76681345c8e0baf793e1c698f897902188d5ae820

                      SHA512

                      c496bbb6b4bd23afd440cc58079f8eb92ec61d0979452f217910a3965f20498c421306abc5923cd4363f521dc6fbab16d07ea7050ab2f784b6c6024b93b10fb4

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\CabA709.tmp
                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\TarA748.tmp
                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Tmp9D2A.tmp
                      Filesize

                      2KB

                      MD5

                      1420d30f964eac2c85b2ccfe968eebce

                      SHA1

                      bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                      SHA256

                      f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                      SHA512

                      6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\is-C38AM.tmp\OEWHsjMugMHVUSe6mwjehoSC.tmp
                      Filesize

                      680KB

                      MD5

                      fcb9a039e355dca5927a620396662e9d

                      SHA1

                      ebd8951e470635332cbf43afaf277e6eeaa1aaaf

                      SHA256

                      7e94a78d2279d7b9760b5c720c4cab64cfe4384ec6ea6f4e39e1a65609890976

                      SHA512

                      653b0fe17c4074a3c5e8058873b4a2ce7dcb2738f6f2e28dd00ca089214a8554b3782a1f152288cef96dd4027bf31b1d5672a906ccc21e4ceae14a43fa4d020d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\nlvwyuxd.exe
                      Filesize

                      11.9MB

                      MD5

                      57a370a3c9d8153daaf354c2a93e807f

                      SHA1

                      725692cc0351419495c2795b99e1a94c94299361

                      SHA256

                      2630ac035e1ff15ff73702b3bf372cfc5af2eae5b5c2b833f076df98cb6ab4a4

                      SHA512

                      f6e54d2dc29a40d2ba5c8d789e083f824c10acdc5be271bc054627dbfe786f73bc553a53481c427c515acef9a665d257e83a7040811231939db999b78b9ca93c

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\2f3BA_tHgJQpmVn28JifnF08.exe
                      Filesize

                      1.7MB

                      MD5

                      5bf21229b0e8c6361a56f0aec0121cc4

                      SHA1

                      a46472a1168dad39660f923bb25dc333d24cd2cb

                      SHA256

                      249001bdb6015ef538d4654e6f5c5a1522b7382987ec926d062578ae973f8a71

                      SHA512

                      5de8222c9ae3a6f89a368722cb226f1f82d4b290831c44d3ab84f0d21a3d9432c4dfa126ec53501d0f49227d27c911cd4fe89361d13951117b06897cc52baf0f

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\IZjZPH9oO9A8PQeCS5PMUuAP.exe
                      Filesize

                      423KB

                      MD5

                      b2e864c2f8f6e243822a5c133bb41061

                      SHA1

                      5571df4cdc5b65cdc315c95ee52344dda7f12b20

                      SHA256

                      2cccbfbe95b716e6f8b5ed1634b9ae4e6ab87e1355804ca5aea8d353673ff6a2

                      SHA512

                      32a6087702abe92daab3e2c194b07006f5b9d3cdf48c692d23775f0d75e2941882920767148564ac7fedc417beadb1ae75734f240d07bec30eb262ae4f534e73

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\MlIQrhcIhmVCbQDsrEQn6hL4.exe
                      Filesize

                      10.4MB

                      MD5

                      025ebe0a476fe1a27749e6da0eea724f

                      SHA1

                      fe844380280463b927b9368f9eace55eb97baab7

                      SHA256

                      2a51d50f42494c6ab6027dbd35f8861bdd6fe1551f5fb30bf10138619f4bc4b2

                      SHA512

                      5f2b40713cc4c54098da46f390bbeb0ac2fc0c0872c7fbdfdca26ab087c81ff0144b89347040cc93e35b5e5dd5dc102db28737baea616183bef4caecebfb9799

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\OEWHsjMugMHVUSe6mwjehoSC.exe
                      Filesize

                      3.4MB

                      MD5

                      7a2ac5711382c571a1adc3f296cf10dd

                      SHA1

                      101ea008e9556045ca374e7304680e164bcbeda8

                      SHA256

                      5ee907cd468e9d572557e7b8326cd1c577edb733117fa47949fde2989d32144f

                      SHA512

                      7d7a710b66dc015428e230182761094aa16cd5e48f459aa6e1a64bcdefbbcf5a37118a04bd79ba81f97b69ec8d0c75c9ba5cf8ed2cbae7389fdfb02dd28907a6

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\_b2DzgFESmNupBrOZqH1QyWa.exe
                      Filesize

                      313KB

                      MD5

                      6b19e5c100db0812ffb7813a1503c05d

                      SHA1

                      17032c0b1b056bec3f23786bad5aa17404de3297

                      SHA256

                      516b1a67a3aafceadff083854b26512174cbed4d455c5d8f8993acc8a895ea2e

                      SHA512

                      fb97bd74aae13cb4d0205cf704300dfc4f0678dcbd07aacc295bc13b666a4bff46f12786c2d37702a7a783e786a6a92df31df37a39ebcaee74d46c58e0c4e27c

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\cl72WfKJXpWJZQ8APmUcRgLS.exe
                      Filesize

                      283KB

                      MD5

                      6f99968cc27d2d6a07a921ab703a5d5d

                      SHA1

                      1b1f72a9ca325b2d7b01f66ae1ebef646b167ec0

                      SHA256

                      5ef282479f0c6f082f15d3f878f8c4b418259ebc6d7941a472e0f28cdcc43c88

                      SHA512

                      3ea9cbbb6ab281c02aef8473f40ec00412a05b613d4a45e228e06f4a585ae25ba35dc2eb2a772cf9ab38e86a05b67a4388b4ef306483ef030666d1c242ba370a

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\d_LqOyosQVBLJULcMwoiDt6h.exe
                      Filesize

                      206KB

                      MD5

                      998f7fb6068e4377618bcdb2138bc6f0

                      SHA1

                      2339b59c00bbe3707926a0f4a5964b5e76d18d57

                      SHA256

                      15a0da7dfccb96d1a46f5eef42ceaa7fcb49da5c88e32fc78921d6a9b20f12be

                      SHA512

                      d0896f66aa2422c467daa57612afdf4dffaca1b788ee4f34ecf6f15225aafe879142e9d3bac4db584bcfe9bb8ad47a32c26c9ea0dc7e04370251eac64d4bc9d6

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\fl74_lG80XXMpKMOvaIGLvSG.exe
                      Filesize

                      8.3MB

                      MD5

                      b5887a19fe50bfa32b524aaad0a453bc

                      SHA1

                      cd1f3905959cd596c83730a5b03ceef4e9f2a877

                      SHA256

                      fce5cbeec1eb5274fc3afa55e57fb2f724688cb9d4661a8a86716011493564c7

                      SHA512

                      5b9914c94101b53314b14335e687552e5da0a4085afb826ae94f45769e9b1e66a35624b6e6b60257514f4adf2acc5c9e048bfa3a24aafb891d203e3011c02538

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\jHfb4pfbrQoklLLfzCz3zu3K.exe
                      Filesize

                      812KB

                      MD5

                      7972b08246e568495d9d116fc2d0b159

                      SHA1

                      3e12225494f08369858453fd9fc7481b4f788165

                      SHA256

                      2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84

                      SHA512

                      f0ead246f31d1badb3cd5fd67cb5b3081f027fdad44dd50364734d61722f1bc2cacb1ad5d842ca3f7000a2699e7bdf059a508b54a95f5e155ae274d70e833ff7

                      Download Submit

                    • C:\Users\Admin\Documents\iofolko5\mrfH53W_UOps4E2YW2zcAy43.exe
                      Filesize

                      516KB

                      MD5

                      d8ecb462d3046a0ee172551c5d505c8e

                      SHA1

                      54f9e16b497579964e9afc90c3c0c208f16b4418

                      SHA256

                      afb9edbf499a4726d798cda9f0f372b4b1019033b68d5eb87a8a83ecb7463d6f

                      SHA512

                      9eed44c24a71b44e90efc853b75d2103faa3f8518e1efad45c8c4733ee0396c51e8ea11ba6e7d2ac4f30234e6380c3325227cced8d1753373581eb45073c012e

                      Download Submit

                    • \ProgramData\mozglue.dll
                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      Download Submit

                    • \ProgramData\nss3.dll
                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\is-DGQRR.tmp\_isetup\_iscrypt.dll
                      Filesize

                      2KB

                      MD5

                      a69559718ab506675e907fe49deb71e9

                      SHA1

                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                      SHA256

                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                      SHA512

                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\is-DGQRR.tmp\_isetup\_shfoldr.dll
                      Filesize

                      22KB

                      MD5

                      92dc6ef532fbb4a5c3201469a5b5eb63

                      SHA1

                      3e89ff837147c16b4e41c30d6c796374e0b8e62c

                      SHA256

                      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                      SHA512

                      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                      Download Submit

                    • memory/984-214-0x0000000000400000-0x0000000000452000-memory.dmp

                      Filesize

                      328KB

                      Download

                    • memory/984-210-0x0000000000400000-0x0000000000452000-memory.dmp

                      Filesize

                      328KB

                      Download

                    • memory/984-212-0x0000000000400000-0x0000000000452000-memory.dmp

                      Filesize

                      328KB

                      Download

                    • memory/984-218-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/984-219-0x0000000000400000-0x0000000000452000-memory.dmp

                      Filesize

                      328KB

                      Download

                    • memory/984-216-0x0000000000400000-0x0000000000452000-memory.dmp

                      Filesize

                      328KB

                      Download

                    • memory/984-220-0x0000000000400000-0x0000000000452000-memory.dmp

                      Filesize

                      328KB

                      Download

                    • memory/984-221-0x0000000000400000-0x0000000000452000-memory.dmp

                      Filesize

                      328KB

                      Download

                    • memory/1188-197-0x00000000001E0000-0x0000000000A22000-memory.dmp

                      Filesize

                      8.3MB

                      Download

                    • memory/1188-209-0x0000000004EE0000-0x0000000005090000-memory.dmp

                      Filesize

                      1.7MB

                      Download

                    • memory/1188-261-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/1204-223-0x0000000000400000-0x0000000000657000-memory.dmp

                      Filesize

                      2.3MB

                      Download

                    • memory/1204-225-0x0000000000400000-0x0000000000657000-memory.dmp

                      Filesize

                      2.3MB

                      Download

                    • memory/1724-222-0x0000000000CA0000-0x0000000000D28000-memory.dmp

                      Filesize

                      544KB

                      Download

                    • memory/1944-494-0x0000000000290000-0x00000000002DA000-memory.dmp

                      Filesize

                      296KB

                      Download

                    • memory/2188-195-0x0000000077C80000-0x0000000077C82000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2188-191-0x0000000077C80000-0x0000000077C82000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2188-193-0x0000000077C80000-0x0000000077C82000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2368-207-0x00000000002D0000-0x000000000031A000-memory.dmp

                      Filesize

                      296KB

                      Download

                    • memory/2476-2-0x0000000005B80000-0x0000000005E7E000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/2476-3-0x00000000005D0000-0x00000000005F2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/2476-1-0x0000000000F10000-0x000000000182C000-memory.dmp

                      Filesize

                      9.1MB

                      Download

                    • memory/2476-0-0x000000007481E000-0x000000007481F000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/2504-525-0x0000000000800000-0x0000000000858000-memory.dmp

                      Filesize

                      352KB

                      Download

                    • memory/2640-26-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-23-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-129-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-164-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-5-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-156-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-196-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-174-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-179-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-10-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-185-0x00000000058A0000-0x0000000005F2F000-memory.dmp

                      Filesize

                      6.6MB

                      Download

                    • memory/2640-182-0x00000000058A0000-0x0000000005F2F000-memory.dmp

                      Filesize

                      6.6MB

                      Download

                    • memory/2640-170-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-138-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-134-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-124-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-96-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-47-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-38-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-15-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-22-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-24-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-25-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-19-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-27-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-28-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-20-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-29-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-17-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-30-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-31-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-33-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-34-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-32-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-146-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-21-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-6-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-8-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-9-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-11-0x0000000000400000-0x00000000005E0000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/2640-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/2676-275-0x0000000000AF0000-0x000000000117F000-memory.dmp

                      Filesize

                      6.6MB

                      Download

                    • memory/2676-187-0x0000000000AF0000-0x000000000117F000-memory.dmp

                      Filesize

                      6.6MB

                      Download

                    • memory/2744-149-0x0000000000400000-0x0000000000414000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/2772-203-0x00000000000D0000-0x0000000000124000-memory.dmp

                      Filesize

                      336KB

                      Download

                    • memory/2880-243-0x0000000000870000-0x00000000008A8000-memory.dmp

                      Filesize

                      224KB

                      Download

                    • memory/2972-294-0x0000000000400000-0x0000000000486000-memory.dmp

                      Filesize

                      536KB

                      Download