Overview

overview

10

Static

static

1

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-09-2024 01:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    403KB

  • MD5

    e0a861bd26bf65d25bb61f8ebbe81e50

  • SHA1

    b06e237cde5ffb36b8a388c47b150b20784666fa

  • SHA256

    f083e21b36dd20620436ee2fa9a7f8f98dd7ca182ed5e1cd19d05455a0b4ab68

  • SHA512

    7753c4b21788a5bf1810f5f1dd7debee302f0fad9a383d4dc4f0aaa2e340988eef4676284631d9bd5338552b62714b80e33e626258e7d265248041ece75901de

  • SSDEEP

    6144:wcKudp8ds++opu1J+TIYwuTUT8SJXdbar3LrEIssLgNLYglq/sD1ShTd1J3DAol+:ZTa9puuTSn8SPujLr31DcGDtm28EO

Score
10/10
lummastealcvidar9bf5e431869643a2ac397d2dc0d687fbdefaultcredential_accessdiscoverypersistencespywarestealer

Malware Config

Extracted

Family

vidar

Version

11

Botnet

9bf5e431869643a2ac397d2dc0d687fb

C2

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

stealc

Botnet

default

C2

http://46.8.231.109

Attributes
  • url_path

    /c4754d4f680ead72.php

Extracted

Family

lumma

C2

https://stogeneratmns.shop/api

Signatures

  • Detect Vidar Stealer 14 IoCs
    stealer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Drops startup file 17 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 17 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\ProgramData\AAKKKEBFCG.exe
        "C:\ProgramData\AAKKKEBFCG.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Users\Admin\AppData\Local\Temp\Malewmf\MFDBG.exe
          "C:\Users\Admin\AppData\Local\Temp\Malewmf\MFDBG.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:864
          • C:\Users\Admin\AppData\Local\Temp\Malewmf\FDWDZ.exe
            "C:\Users\Admin\AppData\Local\Temp\Malewmf\FDWDZ.exe" --checker
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2324
      • C:\ProgramData\AKJKFBAFID.exe
        "C:\ProgramData\AKJKFBAFID.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2756
      • C:\ProgramData\FIDAFIEBFC.exe
        "C:\ProgramData\FIDAFIEBFC.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:320
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:1688
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEBKJDBAAKJ.exe"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1752
            • C:\Users\AdminEBKJDBAAKJ.exe
              "C:\Users\AdminEBKJDBAAKJ.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1872
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Modifies system certificate store
                PID:1948
                • C:\ProgramData\GCGHJEBGHJ.exe
                  "C:\ProgramData\GCGHJEBGHJ.exe"
                  8⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2176
                • C:\ProgramData\HJEBGHIEBF.exe
                  "C:\ProgramData\HJEBGHIEBF.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:1608
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:1960
                • C:\ProgramData\CGIJJKEHCA.exe
                  "C:\ProgramData\CGIJJKEHCA.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:1692
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    9⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Checks processor information in registry
                    PID:1648
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminGDBKJDGIJE.exe"
                      10⤵
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      PID:1616
                      • C:\Users\AdminGDBKJDGIJE.exe
                        "C:\Users\AdminGDBKJDGIJE.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:2360
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          12⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Checks processor information in registry
                          PID:1784
                          • C:\ProgramData\DAAFBAKECA.exe
                            "C:\ProgramData\DAAFBAKECA.exe"
                            13⤵
                            • Drops startup file
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1864
                          • C:\ProgramData\BGIIEGIDHC.exe
                            "C:\ProgramData\BGIIEGIDHC.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:1692
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              14⤵
                              • System Location Discovery: System Language Discovery
                              PID:2952
                          • C:\ProgramData\BAAAKJDAAF.exe
                            "C:\ProgramData\BAAAKJDAAF.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            PID:2092
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              PID:1632
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIJKJJKFHIJ.exe"
                                15⤵
                                • System Location Discovery: System Language Discovery
                                PID:620
                                • C:\Users\AdminIJKJJKFHIJ.exe
                                  "C:\Users\AdminIJKJJKFHIJ.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  PID:2652
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    PID:2864
                                    • C:\ProgramData\KKKJKEBKFC.exe
                                      "C:\ProgramData\KKKJKEBKFC.exe"
                                      18⤵
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2152
                                    • C:\ProgramData\DHJECFCGHI.exe
                                      "C:\ProgramData\DHJECFCGHI.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:780
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        19⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:484
                                    • C:\ProgramData\GHIDHCBGDH.exe
                                      "C:\ProgramData\GHIDHCBGDH.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:1288
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        19⤵
                                          PID:2604
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          19⤵
                                          • System Location Discovery: System Language Discovery
                                          • Checks processor information in registry
                                          PID:1296
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminBAAFBFBAAK.exe"
                                            20⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:2820
                                            • C:\Users\AdminBAAFBFBAAK.exe
                                              "C:\Users\AdminBAAFBFBAAK.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              PID:2648
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                22⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2284
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminAKEGHIJJEH.exe"
                                            20⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1616
                                            • C:\Users\AdminAKEGHIJJEH.exe
                                              "C:\Users\AdminAKEGHIJJEH.exe"
                                              21⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              PID:1084
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                22⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1740
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIDHIEGIIIE.exe"
                                            20⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1492
                                            • C:\Users\AdminIDHIEGIIIE.exe
                                              "C:\Users\AdminIDHIEGIIIE.exe"
                                              21⤵
                                              • Drops startup file
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2768
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AAEHDAAKEHJE" & exit
                                        18⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1136
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /t 10
                                          19⤵
                                          • System Location Discovery: System Language Discovery
                                          • Delays execution with timeout.exe
                                          PID:496
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEGCBFIEHIE.exe"
                                  15⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2456
                                  • C:\Users\AdminEGCBFIEHIE.exe
                                    "C:\Users\AdminEGCBFIEHIE.exe"
                                    16⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:2576
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      17⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1092
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminEGIDAFBAEB.exe"
                                  15⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2164
                                  • C:\Users\AdminEGIDAFBAEB.exe
                                    "C:\Users\AdminEGIDAFBAEB.exe"
                                    16⤵
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1924
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HJEHIJEBKEBF" & exit
                              13⤵
                              • System Location Discovery: System Language Discovery
                              PID:1872
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout /t 10
                                14⤵
                                • System Location Discovery: System Language Discovery
                                • Delays execution with timeout.exe
                                PID:1296
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminHIIIECAAKE.exe"
                        10⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:2720
                        • C:\Users\AdminHIIIECAAKE.exe
                          "C:\Users\AdminHIIIECAAKE.exe"
                          11⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:3044
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:3036
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminHJJJJKEHCA.exe"
                        10⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:2908
                        • C:\Users\AdminHJJJJKEHCA.exe
                          "C:\Users\AdminHJJJJKEHCA.exe"
                          11⤵
                          • Drops startup file
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2400
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HCFCFHJDBKJK" & exit
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2592
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 10
                      9⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:2900
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminIJKKEHJDHJ.exe"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1640
              • C:\Users\AdminIJKKEHJDHJ.exe
                "C:\Users\AdminIJKKEHJDHJ.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2200
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:2616
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDAFBGHCAKK.exe"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2256
              • C:\Users\AdminDAFBGHCAKK.exe
                "C:\Users\AdminDAFBGHCAKK.exe"
                6⤵
                • Drops startup file
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1536
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KKFHJJDHJEGH" & exit
          3⤵
          • System Location Discovery: System Language Discovery
          PID:1788
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            4⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:496

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    2
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    4
    T1552

    Credentials In Files

    4
    T1552.001

    Discovery

    Browser Information Discovery

    1
    T1217

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    3
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\AAKKKEBFCG.exe
      Filesize

      26KB

      MD5

      0677d5eb007dc9b0de2c5ddf8c3886d8

      SHA1

      d455b38856bb2a143e5edc2ade8db811e4e9a71b

      SHA256

      f33f40367e6a3878f2c8df07683413c77126150d076684fdbc295e9a7a0e5164

      SHA512

      983d9081093f838e6b1b2a5a70e4726caa8fe4a54e83c0bc66985751a88ca9122e5c14688d18c0b9b738195a22ac40900de39c4f49267dca72e22cc9aaa7bf88

      Download Submit

    • C:\ProgramData\AKJKFBAFID.exe
      Filesize

      368KB

      MD5

      28f06ee2c727adcae5a328aaf02d95fe

      SHA1

      3c73c34aafb67d828341906877894670d2f113fc

      SHA256

      df52ba7d8ae16928e82e3554558d25b7582d3e67025a7dfbb71f6231ba9a7899

      SHA512

      d292b0b49f280ad1a955c1eeb720ef6bbb23339928e4f33326997a1a69f85ddf91fcf6f1e0ccec8f1b969a1c91d29c41b0dbacb249c40b3a83d50c9b9c37a806

      Download Submit

    • C:\ProgramData\HCFBKKEB
      Filesize

      92KB

      MD5

      f98745d81e8b84f39630844a63afc1ee

      SHA1

      d7977c2dab5de25630f7d869f9b16a8502cd3bb3

      SHA256

      9c34e13f0d2852fb4a8a53a4727a59d24691a507edb6ff1965024a6147799a83

      SHA512

      e6b1bf12139e627d6aa2b25c9d7e8ebab1e86fc3025655bf88bc735413f55b10490f0237b8d11fd5db0eb6045f6176e93228c70d8e940a62ea4324816c31a3dd

      Download Submit

    • C:\ProgramData\HCFCFHJDBKJK\AKJKFB
      Filesize

      46KB

      MD5

      02d2c46697e3714e49f46b680b9a6b83

      SHA1

      84f98b56d49f01e9b6b76a4e21accf64fd319140

      SHA256

      522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

      SHA512

      60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

      Download Submit

    • C:\ProgramData\HCFCFHJDBKJK\BKFCBF
      Filesize

      96KB

      MD5

      d367ddfda80fdcf578726bc3b0bc3e3c

      SHA1

      23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

      SHA256

      0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

      SHA512

      40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

      Download Submit

    • C:\ProgramData\HCFCFHJDBKJK\BKFCBF
      Filesize

      5.0MB

      MD5

      13cd3dc80ad94c33c6b0aa087e917694

      SHA1

      30818dd4f9ba1c238f1828c35350fab0d3d38022

      SHA256

      c09805aec6fe8822572673e7fb38a81c6394e74a28dc7b62e843d9e19cbb9cc6

      SHA512

      8d671bbeacb2a54adfec2bd841b617c0a63e571393831bc7508792222b834a2b7d746415b9906a133b5d581a76b2c283f6eed8468f4a71b9a175c2ad9e254874

      Download Submit

    • C:\ProgramData\HCFCFHJDBKJK\HDAFHI
      Filesize

      20KB

      MD5

      c9ff7748d8fcef4cf84a5501e996a641

      SHA1

      02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

      SHA256

      4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

      SHA512

      d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

      Download Submit

    • C:\ProgramData\IJEBKKEGDBFIIEBFHIEH
      Filesize

      6KB

      MD5

      6f70e284166b8ce6c792f1c01fbf37d1

      SHA1

      997e5b9fd18d4d0a4e5a26387c8b4366c5d3d3c9

      SHA256

      6a91df1b09ecd1761f7383c26040c3c568026f474d5a0e029b04c54dda73bb7f

      SHA512

      d6ac86852a7172489959c2e155f978e674fb9830a799161e4fef841badb21e6beb031b14cfa12b1025f11fe85be3056043354b24debff1c7fa2f53c6c4daac93

      Download Submit

    • C:\ProgramData\freebl3.dll
      Filesize

      669KB

      MD5

      550686c0ee48c386dfcb40199bd076ac

      SHA1

      ee5134da4d3efcb466081fb6197be5e12a5b22ab

      SHA256

      edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

      SHA512

      0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

      Download Submit

    • C:\ProgramData\freebl3.dll
      Filesize

      144KB

      MD5

      b19a288520c439d8090b7469d7ebbd7e

      SHA1

      f37b9d42c3e7540405e3e2410708c65b909b7637

      SHA256

      8a25a619a2962aa18a12936190f4c8ad5faae33ff23d461fa920257f6c1ee615

      SHA512

      bfa3fa2a01282eb20361a0ef2a778445583e9c876e9cc09e6a447fdb5da9db31b296d5172f68f9b1d03625477e18d322dd7102949f389e335a204eb75e29236d

      Download Submit

    • C:\ProgramData\mozglue.dll
      Filesize

      32KB

      MD5

      3cc0f98531b5afa6eb161d94b8b472d0

      SHA1

      7d2af29a3e6ad6d9adb56cf19224ba77c56b9111

      SHA256

      df2d29b70226512bea8b3fb1539e4c355d98f80f7fcb86999385316823de223d

      SHA512

      07086b8ae74aec55e3d773de7a5c8ee6994d7130610c2fff46b6898fc50b06a5506743f31170b62f74f6df11074048c8ae3ff230b5648ca5ef62987a2fbd8de6

      Download Submit

    • C:\ProgramData\msvcp140.dll
      Filesize

      439KB

      MD5

      5ff1fca37c466d6723ec67be93b51442

      SHA1

      34cc4e158092083b13d67d6d2bc9e57b798a303b

      SHA256

      5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

      SHA512

      4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

      Download Submit

    • C:\ProgramData\msvcp140.dll
      Filesize

      150KB

      MD5

      cf252101f4591f302071cee43ad7fe4f

      SHA1

      e7cfff62ae71dff4e3ca7a8d639175aed9d9b3e1

      SHA256

      1cacaec630c05abc70f81faa7c01f7ff90c2a3ba68e7b177619b2dd14de8c3a7

      SHA512

      dd597b2c1da26e4d87f9593dc9c55c3b892c35a5326a58c9bb0f194aa3e036c74f59245bd04aa7f2b5b50fac8968eb944835999f4122014e97d938211c0861f3

      Download Submit

    • C:\ProgramData\nss3.dll
      Filesize

      5KB

      MD5

      fff8bb74ff31eb63f0386737a00b6d0a

      SHA1

      eaf6b3268e69a783aee4f97c4a2daa9bd153d6fe

      SHA256

      fdbb1e867d9aff33fa30c8e2d1f0cf18faa97c27851767720035b05e67100cc6

      SHA512

      dc77574ca6d10edc96901776022b1d10bd2b0295647c61ea97dd806b744a217d807edbea13af13fbd458a3f3c8553924df46d4ebff829a02f191c63142f6699a

      Download Submit

    • C:\ProgramData\softokn3.dll
      Filesize

      251KB

      MD5

      4e52d739c324db8225bd9ab2695f262f

      SHA1

      71c3da43dc5a0d2a1941e874a6d015a071783889

      SHA256

      74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

      SHA512

      2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

      Download Submit

    • C:\ProgramData\softokn3.dll
      Filesize

      132KB

      MD5

      1beb4066bef4642fd054749fa16f1e8e

      SHA1

      7ebe091099c633497a3cafab17cc480426ea4065

      SHA256

      3ff4929344bf8e269905036428cdc449e36e80e539644acae7ec117b508c3cbc

      SHA512

      a4735046f45fe7ad6891c900367eb97ce5221991c77da0f5a31e6488594240e7ea385578a3f8333a4c4cc2f1970e2ad07133771c094a72fd0f0b80f68db4746d

      Download Submit

    • C:\ProgramData\vcruntime140.dll
      Filesize

      78KB

      MD5

      a37ee36b536409056a86f50e67777dd7

      SHA1

      1cafa159292aa736fc595fc04e16325b27cd6750

      SHA256

      8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

      SHA512

      3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

      Download Submit

    • C:\ProgramData\vcruntime140.dll
      Filesize

      55KB

      MD5

      af2d1bd5d9f7a5583b49025411728bff

      SHA1

      df19d9050ba7442004058f7faecf4a4fdbb7c882

      SHA256

      88f5c756304585138408845fb42a0e1a3c71929710fc23d9c34ba5bf1f0d429b

      SHA512

      955aa88c5caeaae348bece7ac8d07ca95306dac7542b86d0ce34623b33219d928aacf039b66d988788c2f2116369299e0c648d8838884a1db64e14347787bd94

      Download Submit

    • C:\Users\AdminEBKJDBAAKJ.exe
      Filesize

      403KB

      MD5

      80729909b073a23f2caf883d9b9dce98

      SHA1

      cf621df3f09b1103e247e1292e6c9d4894e90d92

      SHA256

      b832829177dcfb2f224062fdf796ffdce054c66ac391d4a2efdec7e06aeb69ee

      SHA512

      e197b71e9b91aa83f6ff0ca454a8ea72c66043449901595613d4d6ad8ac0e007e7ed10c6b1a428692eb6d2a29fd114b0afcfe7a678b6fb11b475ea6fb5ce0b05

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
      Filesize

      471B

      MD5

      2b36821f56b5af8c6696d071788bdcbf

      SHA1

      19bc0e2633ad82f28beb4e7e72cf3b208f3ba435

      SHA256

      6bd2e70bec06d9aaf7d4a4e43e05ec5cd6d86ba1ee462a4a43881c5fc7e1ab02

      SHA512

      eebf46211ad75641582459ae8fbbefc29a6d402fc03576738dd8d9f17c9675a2befdcfa1d84120202e39a47bcf721e341cdd8628c5b269ee489f6ac038268f1e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      f9d5716d5adf8a37fec905a69e52bead

      SHA1

      62f3015692a19b8fb2f82c53ae665d58986ae6c3

      SHA256

      22d49bb0a9116cc6d2dea3b64cf521e83276a0b7b66d21564b562b7315e76392

      SHA512

      9a4e4228c8c12c5356635e97afeb3c11108a3a08d641256dc866ffdddce268014bc8c5f6bed3c55f8b650b0933ef73160ec8b92f3ef5ba7a0d20a5f01f13faa3

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
      Filesize

      400B

      MD5

      9980901549c92a79434183a04f655bb1

      SHA1

      749f6932ce64394e0826895d70dda696363b2a69

      SHA256

      414ee38eccc2b2f7748b2ecc4531e0b0fd99f5c327de5d59984b86638bc3887a

      SHA512

      8a3e90fc04b11367e09908ba60ee3f67d540fab53629eab138d8de743c61a9b090dee4667c23bb2cfd9a35a2a32d1ac58c1548d64ebc045dc38c1d5aa5c25a25

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\76561199780418869[1].htm
      Filesize

      33KB

      MD5

      bfbfb303eaa1f5c71333ec69b56994f6

      SHA1

      003bf554a5a8ed7d67bb63912af12f8891f343ee

      SHA256

      4ad394657553c1b0ee0ed4cfb5fea4be77037f3e84e266ff9aa51b710b526264

      SHA512

      89f1d8545d0d1a5ede1c9872776970e017fa7ec85252b68b79a6754dfd74945dba649fa7d85dccd96a63593b63c87d3ecffb5930c9fc2d12563636716e9cc964

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\76561199780418869[1].htm
      Filesize

      33KB

      MD5

      ab9c90f7fc18e16a4c9e65209502347a

      SHA1

      e8d3aa82cb5792ce60b302a5dea44943b89e2c9b

      SHA256

      05d0dfde098cb6c7590460191dbb37eb4fcb73b0f604b87354858262b43c260e

      SHA512

      1a671ea1c80ab44e6035b81b6368defdd4db2232f968d932bb239842a03253c31d759104d25c36462f24a1066f619c0802095159bb91b1a6df54acaf41614e6c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CabBCAD.tmp
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\TarBCDE.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MFDBG_f9281a9758954f918d9ef6b7f6450b28.lnk
      Filesize

      1022B

      MD5

      357951817ac28dc0432eda1133a57c8d

      SHA1

      aaee479419330aace724e1b3e885c42bd7618972

      SHA256

      acb4ff240fb4af3438db0e78f8873e462e79858fb0e01d0a40e85a0f1155c684

      SHA512

      d403ca3a61655b914ca656f0ffabc5caeed788a32358af3f3331ba1507142143bf18862214e9c7887bed61627b69a0cad7b6177e925766d492dfecebf00eefff

      Download Submit

    • \ProgramData\FIDAFIEBFC.exe
      Filesize

      326KB

      MD5

      4ecc9d9d93e5ff84765dacbb1e54a4c9

      SHA1

      f2f796276b0aa4adcc02f6b9d11aabf1d97f9a06

      SHA256

      eba091f4887e9bc9e0308d4e7830b2ae7b50eddb7c53425bd78db0f959ed6524

      SHA512

      dc093ad97b34a5afad3c324c24425c950f48d5601444c044a718a0e47355a8f125d54a07fd8969ab85a00cce2d3c148a7dc2dcb4628647ed2c8e1ba50955b8cd

      Download Submit

    • \ProgramData\mozglue.dll
      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      Download Submit

    • \ProgramData\nss3.dll
      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      Download Submit

    • memory/320-598-0x0000000000F90000-0x0000000000FE6000-memory.dmp

      Filesize

      344KB

      Download

    • memory/780-2572-0x0000000001080000-0x00000000010E0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/864-529-0x0000000001280000-0x000000000128C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1288-2602-0x0000000001010000-0x0000000001066000-memory.dmp

      Filesize

      344KB

      Download

    • memory/1536-745-0x0000000001190000-0x000000000119C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1608-1259-0x0000000000F80000-0x0000000000FE0000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1688-663-0x0000000000400000-0x0000000000661000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1688-652-0x0000000000400000-0x0000000000661000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1688-654-0x0000000000400000-0x0000000000661000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1688-656-0x0000000000400000-0x0000000000661000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1688-658-0x0000000000400000-0x0000000000661000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1688-667-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

      Download

    • memory/1688-666-0x0000000000400000-0x0000000000661000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1688-664-0x0000000000400000-0x0000000000661000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1688-660-0x0000000000400000-0x0000000000661000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/1692-1289-0x0000000000C80000-0x0000000000CD6000-memory.dmp

      Filesize

      344KB

      Download

    • memory/1692-1915-0x0000000000EE0000-0x0000000000F40000-memory.dmp

      Filesize

      384KB

      Download

    • memory/1864-1881-0x00000000002E0000-0x00000000002EC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/1872-733-0x0000000000320000-0x0000000000388000-memory.dmp

      Filesize

      416KB

      Download

    • memory/1924-2073-0x00000000012F0000-0x00000000012FC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2092-1945-0x0000000001070000-0x00000000010C6000-memory.dmp

      Filesize

      344KB

      Download

    • memory/2152-2539-0x0000000000E80000-0x0000000000E8C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2176-1225-0x0000000000D50000-0x0000000000D5C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2200-746-0x0000000000800000-0x0000000000860000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2324-538-0x0000000000250000-0x000000000025C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2360-1411-0x0000000000B70000-0x0000000000BD8000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2384-0-0x00000000743CE000-0x00000000743CF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2384-1-0x0000000000A20000-0x0000000000A88000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2384-9-0x00000000743C0000-0x0000000074AAE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2384-179-0x00000000743C0000-0x0000000074AAE000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2400-1416-0x0000000000940000-0x000000000094C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2528-159-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-10-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-363-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-213-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-382-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-198-0x00000000205A0000-0x00000000207FF000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2528-425-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-178-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-444-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-17-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-18-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-232-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2528-11-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-14-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-4-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-5-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-3-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2528-7-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

      Download

    • memory/2576-2074-0x00000000008B0000-0x0000000000910000-memory.dmp

      Filesize

      384KB

      Download

    • memory/2604-498-0x0000000000BE0000-0x0000000000BEC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/2604-497-0x0000000072C0E000-0x0000000072C0F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2648-2724-0x0000000000370000-0x00000000003D8000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2652-2068-0x0000000001180000-0x00000000011E8000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2756-618-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2756-626-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2756-624-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2756-622-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2756-629-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2756-630-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2756-620-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2756-632-0x0000000000400000-0x0000000000462000-memory.dmp

      Filesize

      392KB

      Download

    • memory/2768-2729-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

      Filesize

      48KB

      Download

    • memory/3044-1417-0x00000000001C0000-0x0000000000220000-memory.dmp

      Filesize

      384KB

      Download

    • memory/3060-562-0x0000000000E60000-0x0000000000EC0000-memory.dmp

      Filesize

      384KB

      Download