c30ffcd56304c8c37f3a909b8763bf0bac7ee171cf5d9b72bc16a904d3273271

Resubmissions

04/12/2024, 03:29

241204-d2b5qszkgy 6

04/12/2024, 03:28

241204-d1js7avnfr 4

03/12/2024, 21:38

241203-1hgbnsvrds 4

11/11/2024, 08:27

241111-kcemwsvrew 10

Analysis

max time kernel
141s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/12/2024, 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stinger64.exe
Size

46.8MB
MD5

8b2e581985d25d62f445e35272b0166c
SHA1

b9da986997c504d41dbcb2ba092950fb85d8c423
SHA256

c30ffcd56304c8c37f3a909b8763bf0bac7ee171cf5d9b72bc16a904d3273271
SHA512

5951c6714f38444fc3f15a351ffda226f9310282bda15cdc732774e0ea4c217438427cd3beba4fa30cb6dbc741b62377d0806748be7d4a9dd084607d2d46d34c
SSDEEP

786432:yKNN8m/oiShrwFxCU+C5bUWUxEb140g1uwANq03j6QGBMiM5zPJeX57+8DUFJyft:pNaco5JKxCVCtUWX11QuDqMGQ4sJ27+a

Score

6^/10

bootkit defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	stinger64.exe
File opened (read-only)	\??\x:	stinger64.exe
File opened (read-only)	\??\j:	stinger64.exe
File opened (read-only)	\??\k:	stinger64.exe
File opened (read-only)	\??\p:	stinger64.exe
File opened (read-only)	\??\s:	stinger64.exe
File opened (read-only)	\??\y:	stinger64.exe
File opened (read-only)	\??\b:	stinger64.exe
File opened (read-only)	\??\i:	stinger64.exe
File opened (read-only)	\??\r:	stinger64.exe
File opened (read-only)	\??\w:	stinger64.exe
File opened (read-only)	\??\a:	stinger64.exe
File opened (read-only)	\??\e:	stinger64.exe
File opened (read-only)	\??\n:	stinger64.exe
File opened (read-only)	\??\z:	stinger64.exe
File opened (read-only)	\??\o:	stinger64.exe
File opened (read-only)	\??\q:	stinger64.exe
File opened (read-only)	\??\t:	stinger64.exe
File opened (read-only)	\??\v:	stinger64.exe
File opened (read-only)	\??\g:	stinger64.exe
File opened (read-only)	\??\h:	stinger64.exe
File opened (read-only)	\??\l:	stinger64.exe
File opened (read-only)	\??\m:	stinger64.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	mfehidin.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	stinger64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	mfehidin.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	stinger64.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	stinger64.exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\svchost.exe	stinger64.exe
File opened for modification	C:\Windows\system32\Dwm.exe	stinger64.exe
File opened for modification	C:\Windows\System32\smss.exe	stinger64.exe
File opened for modification	C:\Windows\system32\wininit.exe	stinger64.exe
File opened for modification	C:\Windows\system32\winlogon.exe	stinger64.exe
File opened for modification	C:\Windows\system32\lsass.exe	stinger64.exe
File opened for modification	C:\Windows\System32\spoolsv.exe	stinger64.exe
File opened for modification	C:\Windows\system32\DllHost.exe	stinger64.exe
File opened for modification	C:\Windows\system32\services.exe	stinger64.exe
File opened for modification	C:\Windows\system32\lsm.exe	stinger64.exe
File opened for modification	C:\Windows\system32\wbem\wmiprvse.exe	stinger64.exe
File opened for modification	C:\Windows\system32\csrss.exe	stinger64.exe
File opened for modification	C:\Windows\system32\svchost.exe	stinger64.exe
File opened for modification	C:\Windows\system32\taskhost.exe	stinger64.exe
File opened for modification	C:\Windows\system32\sppsvc.exe	stinger64.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\stinger\x64\mfescfqa.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\mferkdet.inf	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeaacsa.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfefirek.sys	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfedisk.cat	mfehidin.exe
File created	C:\Program Files\stinger\x86\vscan.bof	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfeavfk.inf	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfehcs.exe	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfeann.exe	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfefirek.inf	mfehidin.exe
File created	C:\Program Files\stinger\x64\vscan.bof	mfehidin.exe
File created	C:\Program Files\stinger\x64\vseall.xml	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfehidk.cat	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfedisk.sys	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfedisk.sys	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfehck.sys	mfehidin.exe
File created	C:\Program Files\stinger\x64\mferkdet.inf	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfecana.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeelama.dll	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfeplk.inf	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfehidk_messages.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\scriptff.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\dainstall.exe	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeplk.cat	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfeplk.cat	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfehck.sys	mfehidin.exe
File created	C:\Program Files\stinger\x64\hcinfo.exe	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeann.exe	mfehidin.exe
File created	C:\Program Files\stinger\x64\ftl.dll	mfehidin.exe
File created	C:\Program Files\stinger\mfehidin.exe	stinger64.exe
File created	C:\Program Files\stinger\x64\vtpinfo.exe	mfehidin.exe
File opened for modification	C:\Program Files\stinger\test.log	mfehidin.exe
File created	C:\Program Files\stinger\x64\mferkdet.sys	mfehidin.exe
File created	C:\Program Files\stinger\x86\mytilus3_worker.dll	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfewfpk.sys	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfeelamk.cat	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfehck.cat	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfeavfk.sys	mfehidin.exe
File created	C:\Program Files\stinger\x64\dp-file.dll	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfefirek.cat	mfehidin.exe
File created	C:\Program Files\stinger\x64\mcvssnmp.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfehidk.sys	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfetdi2k.cat	mfehidin.exe
File created	C:\Program Files\stinger\x86\dp-file.dll	mfehidin.exe
File created	C:\Program Files\stinger\x64\lockdown.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\scriptsn.dll	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfemms.exe	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfedisk.cat	mfehidin.exe
File created	C:\Program Files\stinger\x86\mferkda.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeplk.inf	mfehidin.exe
File created	C:\Program Files\stinger\x64\mcshield.exe	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfehidk_messages.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\hcinfo.exe	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeaacsk.cat	mfehidin.exe
File created	C:\Program Files\stinger\x86\mytilus3.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\adslokuu.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\mferkdet.cat	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeapconfig.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\ScriptFF.gif	mfehidin.exe
File created	C:\Program Files\stinger\x86\vtpinfo.exe	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeapfa.dll	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfestwa.dll	mfehidin.exe
File created	C:\Program Files\stinger\x64\mfehca.dll	mfehidin.exe
File created	C:\Program Files\stinger\x86\mfeaacsk.sys	mfehidin.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Explorer.EXE	stinger64.exe
File created	C:\Windows\stinger.sys	stinger64.exe

Executes dropped EXE 5 IoCs

pid	Process
1904	mfehidin.exe
2276	vtpinfo.exe
1584	vtpinfo.exe
596	Process not Found
1916	DllHost.exe

Loads dropped DLL 6 IoCs

pid	Process
2652	stinger64.exe
2652	stinger64.exe
3032	Process not Found
2652	stinger64.exe
2448	Process not Found
2792	Process not Found

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	stinger64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	stinger64.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a38948f6a468474da012a16971ea9ccf00000000020000000000106600000001000020000000080eaa83c183b5d4b418d583075e88ac0fbfedef95c13ebb0f3b57d49de9d6cd000000000e80000000020000200000001bc71eb91f3013aa8230cef88b150eb0ac12a676c995365abe22b8a12ffb77a520000000361f0d7a3ccd7d428f8e8aa6ceb7719868f6727749b55c5bed15105ac84e1e3b400000008beea3e3de79820626c847c27223f4fd02a9dde7044792fce78698e71070f4c0db8234e231a2788764b26929875e5bd06c161c5e73eaaa121356f2feb418cb49	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439444943"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a38948f6a468474da012a16971ea9ccf0000000002000000000010660000000100002000000086fa28204c5d255adb58b17bfaa7ecc078f589afcb722485070ffab687f30a2a000000000e8000000002000020000000198d19cef78052c18975fa3d8faeaa3b6b1fa962c42d647f3d71749df9e19ef2900000004a1a5f7b1732a96e481cba717d9f2455bf573f4fca327760c6b3af668a7ed3f5561fc19c2709d0d9d68a8eeffc7d82130b7c4bdb38bff99fa3269a958b3f2f9a3f145ad3095c03cb37ec8def30770419fe048919221af5a30bb89120dbe19b473961f1244d7affe8c57c3d8a7a183a4b3c9f7be25afdb066d1a4aa3da23ed01ad2385efbd4ab2c5d04045ae4bf2f273140000000faf7ec87f811cea78f48d731510fa1c8805d28638b36cde36b7500c9e5e08eb32cf5a882e03a20579636137f15e0ab0c4bf2c37519a40b36825ce5c016ac236d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{376A1831-B1F0-11EF-9F7F-EAF82BEC9AF0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c051c10cfd45db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile"	stinger64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	stinger64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "batfile"	stinger64.exe

Modifies system certificate store 2 TTPs 12 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	stinger64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	stinger64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	stinger64.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\McAfee Trust	mfehidin.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\McAfee Trust\Certificates	mfehidin.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\McAfee Trust\CRLs	mfehidin.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\McAfee Trust\CTLs	mfehidin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	stinger64.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\ISG Trust\Certificates	mfehidin.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\ISG Trust\CTLs	mfehidin.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\ISG Trust	mfehidin.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\SystemCertificates\ISG Trust\CRLs	mfehidin.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe
Token: SeSecurityPrivilege	2652	stinger64.exe
Token: SeDebugPrivilege	2652	stinger64.exe
Token: SeTcbPrivilege	2652	stinger64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2652	stinger64.exe
2896	iexplore.exe
2896	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1904	2652	stinger64.exe	30
PID 2652 wrote to memory of 1904	2652	stinger64.exe	30
PID 2652 wrote to memory of 1904	2652	stinger64.exe	30
PID 2652 wrote to memory of 2276	2652	stinger64.exe	32
PID 2652 wrote to memory of 2276	2652	stinger64.exe	32
PID 2652 wrote to memory of 2276	2652	stinger64.exe	32
PID 2652 wrote to memory of 1584	2652	stinger64.exe	34
PID 2652 wrote to memory of 1584	2652	stinger64.exe	34
PID 2652 wrote to memory of 1584	2652	stinger64.exe	34
PID 2652 wrote to memory of 2896	2652	stinger64.exe	36
PID 2652 wrote to memory of 2896	2652	stinger64.exe	36
PID 2652 wrote to memory of 2896	2652	stinger64.exe	36
PID 2896 wrote to memory of 2860	2896	iexplore.exe	37
PID 2896 wrote to memory of 2860	2896	iexplore.exe	37
PID 2896 wrote to memory of 2860	2896	iexplore.exe	37
PID 2896 wrote to memory of 2860	2896	iexplore.exe	37

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	stinger64.exe

C:\Users\Admin\AppData\Local\Temp\stinger64.exe
"C:\Users\Admin\AppData\Local\Temp\stinger64.exe"
1⤵
- Enumerates connected drives
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2652
- C:\Program Files\stinger\mfehidin.exe
  "C:\Program Files\stinger\mfehidin.exe" -installcab:stinger.cab -guid:{3739AA56-A3C2-4F60-8834-2C392C1C6208} -log:test.log
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Modifies system certificate store
  PID:1904
- C:\Program Files\stinger\vtpinfo.exe
  "C:\Program Files\stinger\vtpinfo.exe" /SetSearchPath "C:\Program Files\stinger"
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Program Files\stinger\vtpinfo.exe
  "C:\Program Files\stinger\vtpinfo.exe" /LoadCerts
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Stinger_04122024_033021.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Executes dropped EXE
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\stinger\VSEALL.xml

Filesize
261KB

MD5
a68a9dc6cf4bf0f75c73ba9ced3adb6b

SHA1
93728fe203c6cf82667af1b73f6639b8cd740305

SHA256
efef1b7fee0e5891eb5dd70b66710cade9f54602da9a14d1fca3d7a95e38c327

SHA512
ff6d14be0b5ee403fdc8e8b720a2dd0db225c325409cfdbc0521136bd7b31d55c0bac83a2e2ec9c816dbb9095e38ad6a30209f616f4ff5495c6ae968f4984862

Download Submit
C:\Program Files\stinger\mfehidin.exe

Filesize
3.7MB

MD5
1464e023ec92600e61d69ccd01e4705d

SHA1
25fd4519b52adad1bf576a3ee52d759020c72550

SHA256
712be540a51e78e0973f2d38de8f90abbdac2ea35744c5f3b8024e951e4242c9

SHA512
1d273e285d03a11a2280879e18199b1d62e423beb991dfdcb9761ae28140651c76c1dd0491104702d5d8fd5c4d06aae3b0ab105c196da7f847f33a8303e5d422

Download Submit
C:\Program Files\stinger\stinger.cab

Filesize
29.4MB

MD5
ed6d834b3902b6a509716c3f63511ec8

SHA1
db81d1a4d8f7be52cfd25b15a384beb708737096

SHA256
d069b301f635bc43cd8352caaaf128e4e7d2785cdfedfb922b3a332824ad7c3c

SHA512
d5af29e017dff4586df0001c831d8f78117c51d2f19526139e4ba01a53e46b5f6d8eb13e0f3317b49d67ab004377bf515f0759acf931432198bcc5d93a11a219

Download Submit
C:\Program Files\stinger\vtpinfo.exe

Filesize
862KB

MD5
4abd84326ea4f99a5daef7836755cf1e

SHA1
5891241b72725b963527dce3abbc9b55827fde06

SHA256
1fc055e15235df6d3a8ebd157482f07defe9024e87446b9c9bf59a2630c660d7

SHA512
c5a6948935af19d856b111746c0cbb920022c6c086b8c44a80d3857bd3a4cbf2333d5affa7fe4961fa8ea80387a3f6b585120aae867631e4d414008947c0e00c

Download Submit
C:\Program Files\stinger\x64\guids.xml

Filesize
16KB

MD5
1c27451eb8f41173fd5b8a8b52f2c50f

SHA1
6c519552da7ee18997e05bb941bddcde976c4061

SHA256
6e5a1919e8a9a589922d6a3298456651ee7d0b0d2e4c81c7de2e433548ba4b81

SHA512
f6835d01f9a1c81a01ec0ad1c5637e9bb0833bebb846edce16ca18a15abf74912fda11226f0c69f7b68c7b1787b459dc823cfe9928773e34e2201e20ce50a941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
1KB

MD5
1b4128283c86d3dc60caac1ad242c71e

SHA1
68668bb9a1178f4556fdd00d58e501a1d864342d

SHA256
8350de0c5360f31c701c6f50e460cf191377298877ec2632d224e5382e700ba9

SHA512
57a412015080d5ae56ee58e63b2805b68b92a615cb22e3146526a40b47847c4474070720608e05b5bb25ef2c7d4aaa7d29153401f480394317774752011e0f45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Filesize
1KB

MD5
d41c54c1a393c65a74353267f36e60a7

SHA1
f4a18efab4eb46a4e2ea23860a05bb0ced5708d0

SHA256
618c053de0ae5871dd75a8627302d0f3f740f9e7a13baf9543763691fca64142

SHA512
c79de2b55aa423f7494c676a854bca76d704d6fae40e0842dce33ad3411d1fa09f0e08506870b6061ee8c1310e5879d028db8319437594f9c83a7f591bf7a7e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_BE709C5553CCE769CE683011AEFB4354

Filesize
1KB

MD5
65b7c8858206d6229511d0c89515e3c2

SHA1
516089e6adeddc4729401b1e8c659ca71940dda4

SHA256
16dcef578db67c1945550466f7f2dadbbc0fc5f990b7875cef53a3552f0ce0ca

SHA512
4bb1e7bd6b80a32fca5a4b0ca7d9fc6e0293e77ff11af64c6c25711d9fd52e70c093c3ad7602d456f26e8d5b10190b4d2fd44ff70333bc3ef02c83e5f53b00a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Filesize
1KB

MD5
7339ea24794182a74d2fe0f53cd626a6

SHA1
7159c8857652e6f15a7636e5f782bf9edf496703

SHA256
c434910595cc6c92a2ddefc8802223b1375f5f39de570a1da62aa2fbc42f5f52

SHA512
b44b3c3d009ff592e97d27a989ca38bc9debeb8962a9f3b35f6c99b0c3fea114ef3c35b1250828ab407bea83a65f0fee048f6209905d06b5b0c94b6fb9ea436f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Filesize
508B

MD5
2aef2877af837054e2a71a519432f126

SHA1
9a5a409ae27c5b1ec46a9bb0209633071665c42c

SHA256
c6e36afd2ed576303fc9160421f0595df17eeda04ff2a75e0add06460b6f7ebb

SHA512
99eeb882db36174936b7b5452aa18311afe7717a4bd71d8f905c21cbb45f34042d7ff2fc220bf464016b653c44fb65f2b47191e6833a225ef05d97f7d42b5506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f6ddf1d81b9fe073497ce563beeb8fdd

SHA1
5b2ce17e9e32685463a17e8624dfb33f038ae44f

SHA256
c986d939397f8bbb1b48c3f9800afe8b2ab0e546f702cd566b9f37eced9bfad3

SHA512
67f41c09fb5724d1bdc77c7d17d33933db23a7e5910ea0451c364df757943bc4f101b6f3db3f5bb50607a77d7a775a2cba344dff003bf8dfdf006150fc82b2f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e923578b74fb7850bde23e822f929bcf

SHA1
c721c9728cc75af66a651233aaa7a475a01ba25b

SHA256
b095f5a0e199a975d3195f3986cff88b0f69baddfc84875cd4b54b49ee1fc806

SHA512
cbc87598f5e545773bc11222992f480fc2c828fd5caf65fcf2e31a330060a8de6ca4849fe3d6f593b89feba23a4ec45fb04ff916ab0bac1eaf9af7f4d9d005cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e2962ab8809e1e5a0d282c1f94d781b

SHA1
6c2215e99f8a56557c5d135b30e1587e3f30cc5c

SHA256
938ca667336b3998ade2b3414889672645769a147ea0ff829d2b4f3619a2b326

SHA512
c593535088a5e7db31a1a3cfb69bb3324c35032d152d9603aae4a14961108cd8c83fffdcea9f14f2a13db1dea111888a3df293b9d6d2c57c8f16285ecb088949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6ebec3f0ebe019a1bb87251c3c176cc

SHA1
d241526b3a0c3544568dd836128abbb44f456940

SHA256
976685b032e845d2b05a3f2ea3dd72cfc572bb0e580d899141ffc05480123c42

SHA512
dd9dac35ca4e1e062576ee610711a69a1301942bc5b474600377966f6bbf0b8f00be6a6d4dfa0845a39474b4a877666b0884db69727074ea92c9d65c87600377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0a593594ab60a9427097b390c3887da

SHA1
cd3449fc06969b7c5d65adf998abca3c59e608c5

SHA256
67eb48e83baeec5e41df3f0148805a1d5422600fc6a6ab872d1356778e338cda

SHA512
d3e38574c9353f8a12f02705dd0236a19dca3203735f6903ed01992accfb63b23e1d4ed348840f5538ac80fee24b3aaec14c9a87566b36d20ed8aaf27d448929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
275ec134725ffdd4ff6c16d1e97201cc

SHA1
b7ee02d9b7fb8bedbfbc14cd8928c375911b7b9b

SHA256
5bbd3235f2440765b85aa960fd6c7d4367e25d8737466572021e881d7d7737a3

SHA512
4567526498ab5ec9dde9cb9cba3c1b4ee29918a5d2abceb69a4f81aef267c6b18106850f843cc840b369b00f1eb744d9e6447222c77107e0d62121b62e2e50de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
521ec19fe87d544dc204cab1bda86e50

SHA1
49ad7708f85552f6ba0f5d3994f957f1f8a73b04

SHA256
c7941d2de3a7f03be420e4eaff5972e90be85b422c34bf6b162507cae7dcf1a4

SHA512
3120572cce6f83de4efbe7d477b3eed2c8fca43dad7be5fd52ebff367c756ea6351ab782fb04d5acbe0e2823a87ce92a72cf2b8da6f7cc7f0693457d3713ec6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0338c154f8b713deb9b414ec1ce3c76

SHA1
5507c788a8544a77985546158a628f430236dea7

SHA256
82dfbe0f65ea90fb2e18a526e83a4d5e9dc42bc123eb4db1950b2b0edecceafd

SHA512
a9b0ed028e30994a374ecbb4d50dc1e9c1905855b92769b001ab7d0fbf1d42fa96c4e60611aeca3491e3608cf05dcdec63ddd11b02de94645107dae2de0423d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a49921b443bb6b91ec900d9c366fa63

SHA1
d0880853bc329f07ddc08857a38418ecf7f03466

SHA256
aa8a4eb8202d39d3e4d42b5d3fc1970240db9cfe4544900b9f9e818346f006da

SHA512
c01b44843fdb52aed8145519cd9733028b47195ff727dd034aba9de8d5d6b2af440dbbe75f181b08397fab461e2b23dc02d600d121b4386209078cb615f1dfc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f66e89ae8daba0fcc07f3c43a19c1cbb

SHA1
4ac2267649eeaec1f2721ab94d8847ee5650271b

SHA256
38e9cfbc6285e409d4fa3dbeabff2270a5f8806ade6fa86be77280c562bf5a54

SHA512
e95c13b440ca5038eecde51a142024a54945d5beced8f9f3b346b83e999b979b579dc44be70c454b25b978647ac83ec22eaafa9331ce346434fb98c3b2c886be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47b753d8cd781972714191d7f243fa4f

SHA1
24211613d82faa94fef3b4b05a4a286c190abaed

SHA256
61c606cd53cd1d03062b157e33d994f1f6786849f462ad698954b5df27172605

SHA512
e3c9024eab7ffc93547dfa800ed56856ebb4670bdcbce7994c32254b61a8b2e76fb3198cad1e710492e50cb89f2706ed25086c12311f057e183524f857c690e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51f8fef6209353bb1b8c91df715536bb

SHA1
3cecb0004593b55b027cac8c0dffba3478cd5ed6

SHA256
209e7174aea6d9a2fbb25d4e4ee79c278190b808a22fda6317514aae12ce5579

SHA512
1c9a41378f4158cd06d0746e74f84d48b446ed946aed1f2887a4a53cefd95348de35aa3d495f40549eed9e2810bdcfc9a2a14658eef21c51f1684055986a90b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5dae82799778e13b0964af7e5d12bd7

SHA1
c2d74bfb3eec218d3bdfa43b80800bc3f393569d

SHA256
ab76612cdb5d50af91f60d237ec254ac75dbceec551ec6804029bc181c9b7a8d

SHA512
52269dd610381918c31eb960110ef195a5154ee0e51a2ac9d0e30489f4d7df4e1539dd6375b7c815fbb2122d7991cf6bec14cd65beee5373ab682500b3702da4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebc8d30ec76b53712fb5114c7b2b4ace

SHA1
742cc0ed2eca8fa3f3ec7484d12f62f695599b14

SHA256
5297e84d13d6ac1c33c2c0a168cedcf2e363d4bd3d17176b1ad1acf1908ce4e1

SHA512
9aa1065d28e6ad0217bc7306a1196e1d7d8705fb8f0f4207f11ff046d4e62a851c9a3f9f56ef3b70a2793d329ba68f977de3163e1f8346d8e956b182d7f161b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65fade2d7c321d0e1b1ca574a0ea6e3f

SHA1
bfbfff45dd2782c1a8b5b5d9a6bbd749e8adb3ed

SHA256
1cf498c1b311423ffa75207bdce120b0954f9cdcb17ca2a6191cff666a65ab44

SHA512
dd461485a2458f174217bca8fd940b1ffba89b17b19904f79a1f8d9e9f507955d9c0027b0f11253e235ce31c053d7e2418affd5eff2f7f27e93ef7eca3aa77ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f992018ed7c771e496331bc6990c89b

SHA1
a48b90b62dab85c2e6ea052904c6b81a585efad5

SHA256
03aa33500c27e75295d57b61b67bf5dd26f77d7b99a6ed231fc99fdc302cf00b

SHA512
356023665fa67de218ab05c8a94d820d80392c1bdfcb661c32dcaa70b1cece8adf6fe338578d70132300f85cfea251b8745aad2df39367bf56546ff78c4042fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28c3a3e5ad50680f086f81c86678ed4a

SHA1
bd29dbea5e17d3a9fe6e798a352576cb4d16268c

SHA256
d3046ebe83ff6f6a29fb040d7a8b436ac420fc36176911c2dfe943539a0a7c17

SHA512
c40b19b90c6430d9ba8db21cdf92bacbfb142c471396c4132236fc25ad0f16ad455742b59e4c54e365270073baa59cf78e61f0acaeeb4d33a24c1426a602fc00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b56830ec76d13e29ee32e8f98cbbb6

SHA1
1f3bcfe32a192de76925ebe80323cbb94d9e54ac

SHA256
f1d4bf10a162234da599d5f3633858168cda5a96229458adf50f00858ff54687

SHA512
ac867e4ef3b8b1d7e40bf58ecc01d2bbf99325f5422ea2a62185a775c8f39d6a41a3e0b61e3c7cf2582d1f3f0b596396e6fc521dec6c468727e0dae2aec8deb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e65dacc4c8b199448cde166eb7e7d7fc

SHA1
3ad637d7794a87371b061a321e2771ee0f51963e

SHA256
5fcbd91171e82d7231ca61e47a5180ef3076906d9138b35e55f2ff0bbe9f11a3

SHA512
200c65654d0597ad7cc0b00ef36966241441d501ff33ebb090601cd30215283faf9a5fab71f931c6663112153e6ba8c94cf5019e48b2a8e9a3b8df1e200080ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22023954f0ddb6b23db52009fd3180c4

SHA1
54cf325e06b25baeeae5f263bcead06f3b9e571c

SHA256
720b29a9d6844bcaa11c212a824aa496147e77be707374474a8567b1b6f8da59

SHA512
42315a4e198a673dfc4b437ece34a1df594f7b15714f3b08a0831eb008462b5c4034ac2b66a476277344d9a48f2faaded08fcc35ea752d85ff92db628357e717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65c34a54c19dd2a54258686bcd64c960

SHA1
ec0392d55797c410e6413fcc231c957584bf4a57

SHA256
a8edf3388c2c553193255d586987608f56ac565371baf183c531cf17a5b04770

SHA512
fc3d4e5a3e135a8d2b36abe275ab31387375df6930b6a62aed0a6f22cf0ec47cb6d332f88ee22739ec122ff3e3752d4d815f67c0e37d6dcad658397064090919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e497ebdcb4cfd1627a29603885a5a5e3

SHA1
6776554626b203a4ac51857b5129d6bfeceef4f6

SHA256
4862193f7f1765a3bbaed0c85daf974e0241bc105154bd44eebe4d1390c842d0

SHA512
242a5cd0bc89fe078c0e006b7d3e71f25aee3029f864197225db390acbf7fd0981c72adb6115ea12726ba3826a43a5ddaefc96e51d2dcc3c148a31c87235bde5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

Filesize
532B

MD5
5cc5aebb719f02b5a2c08d24cbcf3b3e

SHA1
9cb2227f40720398b2d0c2741e9e404ddab2d58f

SHA256
24f47455a3e3b4de5859f42077acebb90a7e252fbe689fbdafe63b96c2cdfe55

SHA512
1b795632a4acf52147db88e75e45466cdc8d03401bec091917671b834c2ad30d72071e53f930298941657b5e773f2b1be0e745197350c3a1b1963ad2866608ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_BE709C5553CCE769CE683011AEFB4354

Filesize
544B

MD5
9eb7c025c32bc7fa3aa3d0384989e56c

SHA1
9fe2baf48167bf0f6e7fde39a69371f2d1d59051

SHA256
ea4d607436f4f08b8f01779706eec4be75f762d477cb611a7b885f6b6d618cb8

SHA512
f87a7c4ad744fc92807804e98b57b3af4ace785a0f3154d458e8d7c4f2f991db26f94a6ae042e8e2077eda089c53654bfd9e584b88db47a1aac38aa3b884824d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C

Filesize
508B

MD5
cfec3bc214bae88a84e0c22b18db5983

SHA1
69a05c136eb2a235638cf6be74248db00f8fa306

SHA256
bd81ded07cbf5d51463d347a50ca3cae6edf2268fafaf4f3df8a370dbaabb1e7

SHA512
1742e420d1354a8ef220b6dceadae8b778eac49c7826858fcf3e14b1ddecfc3a277f416b3e3a9315e14b2252d30ad22f4e16da0a379976b2d83c0b4810db6855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
4f411cb283744609b6c812fb4bdd63bf

SHA1
cd9435f89d8220d92cb3a6cf7c562038582c8660

SHA256
4fb22db0948b5b65eb3923e66261fedd96fc26e0cd275ac2e180e79e46552b19

SHA512
5ae010cb68664fe418c2f6dfa6db0ea83096243d745f58ef6261f20635a9f016afd8f83017285088870ad874e1d6038634c13b91e3a20f6d698d5adf9cd623c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\11223344556677889900112233445566

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6BDF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Stinger_04122024_033021.html

Filesize
820B

MD5
9d00fcdd613c1c2c17824cbb27ce7c45

SHA1
7368fc6c25c2ebd77fe57d87c94ec2347e0b43df

SHA256
421e3c596811f9fb64792652bf9dac13a28b2df2fe03303615702efc769dbc47

SHA512
2506e1ca8a49c41bbc05235a1a3853ffe7265ef51d594ee9d49f34db64fc3ca34f70f0e7783dc509a226a040a218d8d958a63298127e2124c161ec888c96210f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D58.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\runtime.dat

Filesize
1.8MB

MD5
2b73768b4c9a1c87d70b8ae93fbfd320

SHA1
8fe577e5ddbace3e679b738f367ae5352c5bc8c4

SHA256
9664bb979a9e852c4e9940503800ce6949f010a4e567ca5bb018e626b6d6accd

SHA512
8193cfae685de48475a679ae2acbdf79277baab8c2fe70a6e1622daf1941688e4ca21f494ea1ecf744766794da983a4cb185db5df98c30cb00401e0a8a93ace7

Download Submit
C:\Windows\System32\dllhost.exe

Filesize
9KB

MD5
a8edb86fc2a4d6d1285e4c70384ac35a

SHA1
e977b87698c3e595d55827665e22fbf788dd3f9f

SHA256
61b8955ce0a2aa9d0719920b30216717b349b6fbe11c697c31cfa84f859cc1ae

SHA512
7a6ce268167d502d2a623dee6d5bb22aa0bb05dc314785e96e2c4d2de2f5fad337ef698d7678528494eb8d99c470b3f93064c2b2045e72856804992390571bb9

Download Submit
\Program Files\stinger\lockdown.dll

Filesize
65KB

MD5
9b4d3bef728c6fc641fe1c3adc27bfdc

SHA1
989d36dc90aa7f0184b2a067e44178d84672007e

SHA256
83b5408728d345401b3c5be28d1ac3e56da830de5ff54a9ab643a889b418d1df

SHA512
5b1662cd48bef4b57630e516e4a157f806cdccd968bec0ea5a5b6eab19454c5bebb491498c0f0a0031a7cd3a9759325fd17d7e29aace24721fe96b2c8a22f541

Download Submit
memory/2652-638-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-657-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-1225-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-642-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-1-0x0000000146443000-0x0000000146444000-memory.dmp

Filesize
4KB

Download
memory/2652-0-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-639-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-675-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-81-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-82-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download
memory/2652-112-0x0000000146443000-0x0000000146444000-memory.dmp

Filesize
4KB

Download
memory/2652-111-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download
memory/2652-120-0x0000000140000000-0x0000000141000000-memory.dmp

Filesize
16.0MB

Download