Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 00:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    403KB

  • MD5

    80729909b073a23f2caf883d9b9dce98

  • SHA1

    cf621df3f09b1103e247e1292e6c9d4894e90d92

  • SHA256

    b832829177dcfb2f224062fdf796ffdce054c66ac391d4a2efdec7e06aeb69ee

  • SHA512

    e197b71e9b91aa83f6ff0ca454a8ea72c66043449901595613d4d6ad8ac0e007e7ed10c6b1a428692eb6d2a29fd114b0afcfe7a678b6fb11b475ea6fb5ce0b05

  • SSDEEP

    6144:E9rIJUWYO5Mge78Vh5bbBUey+J8f8IztggcO6T4++1dJBMD8tCQSexEO:EiJUWR5MgeChxBUew0IztgO1XJiDYhEO

Score
10/10
lummastealcvidar3a15237aa92dcd8ccca447211fb5fc2adefaultcredential_accessdiscoveryspywarestealer

Malware Config

Extracted

Family

vidar

Version

11

Botnet

3a15237aa92dcd8ccca447211fb5fc2a

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Extracted

Family

lumma

C2

https://stogeneratmns.shop/api

Signatures

  • Detect Vidar Stealer 14 IoCs
    stealer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 17 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 5 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\ProgramData\FIIIIJKFCA.exe
        "C:\ProgramData\FIIIIJKFCA.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1108
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 612
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1264
      • C:\ProgramData\FIIJJKKFHI.exe
        "C:\ProgramData\FIIJJKKFHI.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2932
      • C:\ProgramData\AFHDAKJKFC.exe
        "C:\ProgramData\AFHDAKJKFC.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2340
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2868
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminFHIDAFHCBA.exe"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1440
            • C:\Users\AdminFHIDAFHCBA.exe
              "C:\Users\AdminFHIDAFHCBA.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1744
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                PID:656
                • C:\ProgramData\JEGHCBAFBF.exe
                  "C:\ProgramData\JEGHCBAFBF.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2456
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 612
                    9⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:1672
                • C:\ProgramData\AEGHJEGIEB.exe
                  "C:\ProgramData\AEGHJEGIEB.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:2068
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3056
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 1064
                      10⤵
                      • Program crash
                      PID:2724
                • C:\ProgramData\BGHIIJDGHC.exe
                  "C:\ProgramData\BGHIIJDGHC.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:2028
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    9⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2700
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminJJDHIDBFBF.exe"
                      10⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:1280
                      • C:\Users\AdminJJDHIDBFBF.exe
                        "C:\Users\AdminJJDHIDBFBF.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:2924
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          12⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1712
                          • C:\ProgramData\JJKFBAKFBG.exe
                            "C:\ProgramData\JJKFBAKFBG.exe"
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2872
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 2872 -s 620
                              14⤵
                              • Program crash
                              PID:2300
                          • C:\ProgramData\FHJEGIIEGI.exe
                            "C:\ProgramData\FHJEGIIEGI.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:2180
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:860
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 1068
                                15⤵
                                • Program crash
                                PID:2416
                          • C:\ProgramData\KECFCGHIDH.exe
                            "C:\ProgramData\KECFCGHIDH.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:1964
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2168
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminGIJDGCAEBF.exe"
                                15⤵
                                • System Location Discovery: System Language Discovery
                                PID:2012
                                • C:\Users\AdminGIJDGCAEBF.exe
                                  "C:\Users\AdminGIJDGCAEBF.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  PID:2836
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2788
                                    • C:\ProgramData\GHIDHCBGDH.exe
                                      "C:\ProgramData\GHIDHCBGDH.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:1488
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 612
                                        19⤵
                                        • Program crash
                                        PID:2388
                                    • C:\ProgramData\DAEBFHJKJE.exe
                                      "C:\ProgramData\DAEBFHJKJE.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:1268
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1500
                                    • C:\ProgramData\AKKEGHJDHD.exe
                                      "C:\ProgramData\AKKEGHJDHD.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:2848
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1716
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminHIIIECAAKE.exe"
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1140
                                          • C:\Users\AdminHIIIECAAKE.exe
                                            "C:\Users\AdminHIIIECAAKE.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            PID:1680
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              22⤵
                                                PID:1552
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                22⤵
                                                  PID:2940
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  22⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Checks processor information in registry
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3000
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & rd /s /q "C:\ProgramData\KEBGHCBAEGDH" & exit
                                                    23⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1856
                                                    • C:\Windows\SysWOW64\timeout.exe
                                                      timeout /t 10
                                                      24⤵
                                                      • System Location Discovery: System Language Discovery
                                                      • Delays execution with timeout.exe
                                                      PID:1832
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminCFHCBKKFIJ.exe"
                                              20⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1436
                                              • C:\Users\AdminCFHCBKKFIJ.exe
                                                "C:\Users\AdminCFHCBKKFIJ.exe"
                                                21⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                PID:944
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  22⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2760
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEBGCBAFCGD.exe"
                                              20⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2588
                                              • C:\Users\AdminEBGCBAFCGD.exe
                                                "C:\Users\AdminEBGCBAFCGD.exe"
                                                21⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:2404
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 612
                                                  22⤵
                                                  • Program crash
                                                  PID:2680
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GDBFBFCBFBKE" & exit
                                          18⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2480
                                          • C:\Windows\SysWOW64\timeout.exe
                                            timeout /t 10
                                            19⤵
                                            • System Location Discovery: System Language Discovery
                                            • Delays execution with timeout.exe
                                            PID:2660
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminGHJDHDAECB.exe"
                                    15⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2404
                                    • C:\Users\AdminGHJDHDAECB.exe
                                      "C:\Users\AdminGHJDHDAECB.exe"
                                      16⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:1716
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        17⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2896
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 1064
                                          18⤵
                                          • Program crash
                                          PID:952
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminKFIJJEGHDA.exe"
                                    15⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1804
                                    • C:\Users\AdminKFIJJEGHDA.exe
                                      "C:\Users\AdminKFIJJEGHDA.exe"
                                      16⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:1732
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1732 -s 612
                                        17⤵
                                        • Program crash
                                        PID:2448
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HIIEGHJJDGHC" & exit
                                13⤵
                                • System Location Discovery: System Language Discovery
                                PID:2736
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout /t 10
                                  14⤵
                                  • System Location Discovery: System Language Discovery
                                  • Delays execution with timeout.exe
                                  PID:2460
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIJECAEHJJJ.exe"
                          10⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:2304
                          • C:\Users\AdminIJECAEHJJJ.exe
                            "C:\Users\AdminIJECAEHJJJ.exe"
                            11⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:1120
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              12⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2120
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIDBGHDGHCG.exe"
                          10⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:1724
                          • C:\Users\AdminIDBGHDGHCG.exe
                            "C:\Users\AdminIDBGHDGHCG.exe"
                            11⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2868
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 616
                              12⤵
                              • Loads dropped DLL
                              • Program crash
                              PID:1660
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KEHDHIDAEHCF" & exit
                      8⤵
                      • System Location Discovery: System Language Discovery
                      PID:2324
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout /t 10
                        9⤵
                        • System Location Discovery: System Language Discovery
                        • Delays execution with timeout.exe
                        PID:2980
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEBGIDGCAFC.exe"
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2140
                • C:\Users\AdminEBGIDGCAFC.exe
                  "C:\Users\AdminEBGIDGCAFC.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:1736
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1968
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 1064
                      8⤵
                      • Program crash
                      PID:2768
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminKJDGDBFBGI.exe"
                5⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:376
                • C:\Users\AdminKJDGDBFBGI.exe
                  "C:\Users\AdminKJDGDBFBGI.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:640
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 612
                    7⤵
                    • Loads dropped DLL
                    • Program crash
                    PID:1284
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HDBKJEGIEBFH" & exit
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2348
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 10
              4⤵
              • System Location Discovery: System Language Discovery
              • Delays execution with timeout.exe
              PID:1792

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\GHDAKKJJ
        Filesize

        92KB

        MD5

        ae2cd96016ba8a9d0c675d9d9badbee7

        SHA1

        fd9df8750aacb0e75b2463c285c09f3bbd518a69

        SHA256

        dd0ea2f02d850df691183602f62284445e4871e26a61d9ea72ff1c23c0b0ba04

        SHA512

        7e0e86980b7f928ea847a097545fa07b0c554617768760d4db9afe448568b97d1536a824b7a1b6c1f3fb1bf14153be07ef32676f878fb63a167d47e3136b5d1d

        Download Submit

      • C:\ProgramData\HIIEGHJJDGHCAKEBGIJK
        Filesize

        6KB

        MD5

        8cffa19e86631282a97fe6992b1b03c9

        SHA1

        a40625fdd7ebff52e14c3f435f7f2c4dc842ec48

        SHA256

        642e42e69c46fac7645f23611198509cb00af680048fea511117423f69031eda

        SHA512

        9341d8cc60f9f9150444ce46925aee3c3ed0e4cdbf158312ebf5e0982a151c4451b1949a255496d3386f219f90576016af385edb75d297b5eb691bdce9814036

        Download Submit

      • C:\ProgramData\KEHDHIDAEHCF\BAKJKF
        Filesize

        20KB

        MD5

        c9ff7748d8fcef4cf84a5501e996a641

        SHA1

        02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

        SHA256

        4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

        SHA512

        d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

        Download Submit

      • C:\ProgramData\KEHDHIDAEHCF\FHIEBK
        Filesize

        46KB

        MD5

        02d2c46697e3714e49f46b680b9a6b83

        SHA1

        84f98b56d49f01e9b6b76a4e21accf64fd319140

        SHA256

        522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

        SHA512

        60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

        Download Submit

      • C:\ProgramData\KEHDHIDAEHCF\HJECAA
        Filesize

        96KB

        MD5

        d367ddfda80fdcf578726bc3b0bc3e3c

        SHA1

        23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

        SHA256

        0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

        SHA512

        40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

        Download Submit

      • C:\ProgramData\KEHDHIDAEHCF\HJECAA
        Filesize

        5.0MB

        MD5

        a39637da87237fe48ed47ea7000d1145

        SHA1

        185762bbfd16fdf5be2f21507cfb8a12a076a291

        SHA256

        7ed5cb29cc91ea5306e82edeace6da7ffac31c0ad9436a901ae50dc09bb6c75e

        SHA512

        f3befe15206593a45af4be86800b2fd3b64e6680fdd7ea6fe13fb90f3a1ceea2c2c355ce1298bf11354f58a27f11acf4d4d35386e318d3dce3eaa067d5c42e1e

        Download Submit

      • C:\ProgramData\freebl3.dll
        Filesize

        669KB

        MD5

        550686c0ee48c386dfcb40199bd076ac

        SHA1

        ee5134da4d3efcb466081fb6197be5e12a5b22ab

        SHA256

        edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

        SHA512

        0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

        Download Submit

      • C:\ProgramData\mozglue.dll
        Filesize

        5KB

        MD5

        9096054f47e52ffe6ba779513949904e

        SHA1

        5092f29a19f38fdcbcd85081ddc52cab242a03c5

        SHA256

        cd98a147fb56ccddd01219f3837e352c8f3a7f19ec0efc899622d7ce81998404

        SHA512

        134048b8e668195fb97a254ab3abef0f0b07f57b7d428db9c6f12e8e624dfcb803bf022622ebf7491b14cf249ed5fb4ae11a2486fde2fc47f0ef31509339e36e

        Download Submit

      • C:\ProgramData\msvcp140.dll
        Filesize

        439KB

        MD5

        5ff1fca37c466d6723ec67be93b51442

        SHA1

        34cc4e158092083b13d67d6d2bc9e57b798a303b

        SHA256

        5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

        SHA512

        4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

        Download Submit

      • C:\ProgramData\msvcp140.dll
        Filesize

        19KB

        MD5

        683449b8301b79551001cddab9819806

        SHA1

        dc6eb714fbdb1db928a58b1ab234bca3b9c3c2ec

        SHA256

        8a4747bf5fb0e8c1cc74eb5af9d08786d92ac18afac70fbc9ca0491cf6d2b88b

        SHA512

        1f778ad34333a45df3b1d61c79b93ddc52675b80bf1a2509860a339696edbe65a884cf666f6ecc9153a86a54f007c3d5b13294da53b6f00f27d4be2270860631

        Download Submit

      • C:\ProgramData\nss3.dll
        Filesize

        2KB

        MD5

        5551bc298a66bd457482cb2bb80bd966

        SHA1

        5d27bffc788eaa45309c1731390cc06de112386d

        SHA256

        3053acb03aff586448a1ce89ffca0ca44c9415f6f6b7bf7eae08908b61090a9a

        SHA512

        985abecf289f1707e727ae5f8bf4d7a6bd0b8d4576fd2381d6d2ef512f94faf064e587be0a4b5eaacc80759cac77384efdfa9809df64c02e89e5339401fffe26

        Download Submit

      • C:\ProgramData\softokn3.dll
        Filesize

        251KB

        MD5

        4e52d739c324db8225bd9ab2695f262f

        SHA1

        71c3da43dc5a0d2a1941e874a6d015a071783889

        SHA256

        74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

        SHA512

        2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

        Download Submit

      • C:\ProgramData\softokn3.dll
        Filesize

        10KB

        MD5

        dcd1446dc9e539b6983c30064c32a1fd

        SHA1

        7d827027a4dcd3fb8d091369807f13f735f1f161

        SHA256

        6dcc35a5071877ad3e4428940f30623d708930b6b766a1f642b9a825ef58970c

        SHA512

        098f4f205cbc56d4357efd12a9ce5a96b5d6152d717f5503a1fd1f1d86deba71dc7dcdc3b1d0b0185c9d771de91e0eebd029670e35acaa8d60754af7716aa912

        Download Submit

      • C:\ProgramData\vcruntime140.dll
        Filesize

        78KB

        MD5

        a37ee36b536409056a86f50e67777dd7

        SHA1

        1cafa159292aa736fc595fc04e16325b27cd6750

        SHA256

        8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

        SHA512

        3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

        Download Submit

      • C:\ProgramData\vcruntime140.dll
        Filesize

        23KB

        MD5

        f0659c181fbba7f502cd366fa5ee4888

        SHA1

        50022835ad04100b166e349e909580068830eff7

        SHA256

        8db945720e978d10b72fa8d8f0c7c6d860478ab86a4c58b22bfcec3c402e20e6

        SHA512

        79bed632e91f1aec487066104fe12a62ed2c26179a49f2e7844976886edb0958ad69e0120b11e0a626fd09fd526ba967fec35ffac31470701fa04f9fae8e92ad

        Download Submit

      • C:\Users\AdminFHIDAFHCBA.exe
        Filesize

        403KB

        MD5

        80729909b073a23f2caf883d9b9dce98

        SHA1

        cf621df3f09b1103e247e1292e6c9d4894e90d92

        SHA256

        b832829177dcfb2f224062fdf796ffdce054c66ac391d4a2efdec7e06aeb69ee

        SHA512

        e197b71e9b91aa83f6ff0ca454a8ea72c66043449901595613d4d6ad8ac0e007e7ed10c6b1a428692eb6d2a29fd114b0afcfe7a678b6fb11b475ea6fb5ce0b05

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
        Filesize

        471B

        MD5

        2b36821f56b5af8c6696d071788bdcbf

        SHA1

        19bc0e2633ad82f28beb4e7e72cf3b208f3ba435

        SHA256

        6bd2e70bec06d9aaf7d4a4e43e05ec5cd6d86ba1ee462a4a43881c5fc7e1ab02

        SHA512

        eebf46211ad75641582459ae8fbbefc29a6d402fc03576738dd8d9f17c9675a2befdcfa1d84120202e39a47bcf721e341cdd8628c5b269ee489f6ac038268f1e

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        c1f9cf8bcca613f2af087185effdaf58

        SHA1

        bd528614544fcef2be56fec1c0d33b82b20bd64b

        SHA256

        2973d2936caa75a34a8071a38576a18acd251f6151bca76a53b15e955eebe144

        SHA512

        0d4b04a406d75847f45de0ec1d0b26a09cac38f3b344a2b6ea1192d3f3b84baa33edb30ff26cebc416ca0aff07e9313da1642c482478aec5ec6ccc425f414289

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
        Filesize

        400B

        MD5

        2e3dc8f39dccc3448d8995bfe48b0e1c

        SHA1

        1c93644ce6ac6bc903e112d866d2c071b7373b6c

        SHA256

        7b8fb3240e756ad5a8eb1c72e21ee9eff73f673e0f52212968d361b533f61118

        SHA512

        b1a4c2674df4efe96d6edc6fa47634439a9c866258037bd124a4bd06aac12bb6cc9be78760fc5e466f94d055c5e9a62badfc49f7dc4da1276a455077cab4c98c

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\76561199780418869[1].htm
        Filesize

        33KB

        MD5

        170932826bac94e9925253dcd7723c46

        SHA1

        e469ffb8a613a469e64f8ea5b56db217c24fceb2

        SHA256

        98b81fbbb50e0ed177af6377ffa3a276d3d06b264b826deb831d86c8367927a3

        SHA512

        c77b8d4866fd0c87a97063a55b6ad818f9e8f6dd30182147284251c14b1e40f29c588b54e2665adddad454e503b33d78783ca4dea7f05b3f03f5c392ccbfacf0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab8D82.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar8DA4.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • \ProgramData\AFHDAKJKFC.exe
        Filesize

        326KB

        MD5

        4ecc9d9d93e5ff84765dacbb1e54a4c9

        SHA1

        f2f796276b0aa4adcc02f6b9d11aabf1d97f9a06

        SHA256

        eba091f4887e9bc9e0308d4e7830b2ae7b50eddb7c53425bd78db0f959ed6524

        SHA512

        dc093ad97b34a5afad3c324c24425c950f48d5601444c044a718a0e47355a8f125d54a07fd8969ab85a00cce2d3c148a7dc2dcb4628647ed2c8e1ba50955b8cd

        Download Submit

      • \ProgramData\FIIIIJKFCA.exe
        Filesize

        23KB

        MD5

        5c6e3bc21c044f3eaafb78a95da59678

        SHA1

        87b7544b6e165ea9b4cd14a203c1e8369fc68d0c

        SHA256

        dcea5c016aee094deb47607c1fc6c5698ce915dc1e1d515e2ca5c3e0019b2d40

        SHA512

        fc761169783e9c431a9ca16c490c8ea0ad62997a914c4fdc25fa3d2789b6bbeed042117194a2aa4b18bbce3b0bff9862aa56fced64d2b4dbb5c9bab113fe2c37

        Download Submit

      • \ProgramData\FIIJJKKFHI.exe
        Filesize

        368KB

        MD5

        28f06ee2c727adcae5a328aaf02d95fe

        SHA1

        3c73c34aafb67d828341906877894670d2f113fc

        SHA256

        df52ba7d8ae16928e82e3554558d25b7582d3e67025a7dfbb71f6231ba9a7899

        SHA512

        d292b0b49f280ad1a955c1eeb720ef6bbb23339928e4f33326997a1a69f85ddf91fcf6f1e0ccec8f1b969a1c91d29c41b0dbacb249c40b3a83d50c9b9c37a806

        Download Submit

      • \ProgramData\mozglue.dll
        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        Download Submit

      • \ProgramData\nss3.dll
        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        Download Submit

      • memory/640-722-0x0000000000DD0000-0x0000000000DDC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/944-2712-0x0000000000E80000-0x0000000000EE0000-memory.dmp

        Filesize

        384KB

        Download

      • memory/1108-492-0x000000007326E000-0x000000007326F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1108-493-0x0000000001260000-0x000000000126C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1108-701-0x000000007326E000-0x000000007326F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1268-2553-0x0000000000320000-0x0000000000380000-memory.dmp

        Filesize

        384KB

        Download

      • memory/1488-2521-0x00000000000C0000-0x00000000000CC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1536-376-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-196-0x0000000020230000-0x000000002048F000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1536-225-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-3-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-16-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-356-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-206-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-419-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-438-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-14-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1536-9-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-7-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-6-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-5-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-4-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-12-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-157-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1536-176-0x0000000000400000-0x0000000000676000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/1552-536-0x0000000000390000-0x00000000003F0000-memory.dmp

        Filesize

        384KB

        Download

      • memory/1680-2705-0x0000000001390000-0x00000000013F8000-memory.dmp

        Filesize

        416KB

        Download

      • memory/1716-2056-0x0000000000E00000-0x0000000000E60000-memory.dmp

        Filesize

        384KB

        Download

      • memory/1732-2057-0x00000000001C0000-0x00000000001CC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1736-718-0x0000000001160000-0x00000000011C0000-memory.dmp

        Filesize

        384KB

        Download

      • memory/1744-708-0x00000000002C0000-0x0000000000328000-memory.dmp

        Filesize

        416KB

        Download

      • memory/1964-1927-0x0000000000B20000-0x0000000000B76000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2028-1270-0x0000000001290000-0x00000000012E6000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2068-1240-0x0000000000860000-0x00000000008C0000-memory.dmp

        Filesize

        384KB

        Download

      • memory/2180-1897-0x0000000000A70000-0x0000000000AD0000-memory.dmp

        Filesize

        384KB

        Download

      • memory/2340-572-0x0000000000990000-0x00000000009E6000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2404-2713-0x0000000000FC0000-0x0000000000FCC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2456-1208-0x00000000012F0000-0x00000000012FC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2836-2049-0x0000000001330000-0x0000000001398000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2848-2583-0x00000000010C0000-0x0000000001116000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2868-637-0x0000000000400000-0x0000000000661000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2868-626-0x0000000000400000-0x0000000000661000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2868-630-0x0000000000400000-0x0000000000661000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2868-641-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

        Download

      • memory/2868-632-0x0000000000400000-0x0000000000661000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2868-638-0x0000000000400000-0x0000000000661000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2868-640-0x0000000000400000-0x0000000000661000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2868-634-0x0000000000400000-0x0000000000661000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2868-628-0x0000000000400000-0x0000000000661000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2868-1401-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2872-1865-0x0000000000290000-0x000000000029C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2924-1394-0x0000000001270000-0x00000000012D8000-memory.dmp

        Filesize

        416KB

        Download

      • memory/2932-582-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

        Download

      • memory/2932-584-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2932-585-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

        Download

      • memory/2932-576-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

        Download

      • memory/2932-578-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

        Download

      • memory/2932-581-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

        Download

      • memory/2932-588-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

        Download

      • memory/2932-574-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

        Download

      • memory/2932-586-0x0000000000400000-0x0000000000462000-memory.dmp

        Filesize

        392KB

        Download

      • memory/3028-375-0x0000000074A40000-0x000000007512E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/3028-8-0x0000000074A40000-0x000000007512E000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/3028-1-0x0000000000110000-0x0000000000178000-memory.dmp

        Filesize

        416KB

        Download

      • memory/3028-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

        Filesize

        4KB

        Download