Overview

overview

10

Static

static

3

JaffaCakes...2d.exe

windows7-x64

10

JaffaCakes...2d.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2024 17:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_4eb9b936c2fb7fade00cbd6ea3209d2dc378ba39cbaf5a74bf6b9c5aebda452d.exe

  • Size

    6.0MB

  • MD5

    dd64aefb283080eb01bb9a69ec3f6427

  • SHA1

    0b72f179f63ad9c54e699ce8dcfe4b3c54c0b4a7

  • SHA256

    4eb9b936c2fb7fade00cbd6ea3209d2dc378ba39cbaf5a74bf6b9c5aebda452d

  • SHA512

    f06f19e744c1db5e2310363e3f3fc155bb88338333ead94b0665ff8a71d6e8f4f4cd352b544b62a4617bec2439cd56e84ff2b5a821dc8e0106e75a23a2cbd4c6

  • SSDEEP

    98304:JZUnEVxb/iIIH1YTTbGmRsRDOtOezpvkuGwkMgNAshyNNGBvOWzeMvOYDnuYJZN:JDSISq3bGmRsRD0zO91O4yNNGw2OEnzN

Score
10/10
fabookiegcleanernullmixeronlyloggerprivateloaderredlinesocelars05v1user2aspackv2discoverydropperexecutioninfostealerloaderspywarestealer

Malware Config

Extracted

Family

nullmixer

C2

http://hornygl.xyz/

Extracted

Family

privateloader

C2

http://212.193.30.45/proxies.txt

http://45.144.225.57/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

2.56.59.42

Extracted

Family

socelars

C2

http://www.assassinsx.com/

Extracted

Family

redline

Botnet

05v1user

C2

88.99.35.59:63020

Attributes
  • auth_value

    938f80985c12fe8ee069f692c27f40eb

Extracted

Family

gcleaner

C2

web-stat.biz

privatevolume.bi

Extracted

Family

redline

Botnet

2

C2

193.203.203.82:23108

Attributes
  • auth_value

    52b37b8702d697840527fac8a6ac247d

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie
  • Fabookie family
    fabookie
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • Nullmixer family
    nullmixer
  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger
  • Onlylogger family
    onlylogger
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • Privateloader family
    privateloader
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • Redline family
    redline
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars family
    socelars
  • Socelars payload 1 IoCs
  • Detected Nirsoft tools 4 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • OnlyLogger payload 2 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 28 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 33 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4eb9b936c2fb7fade00cbd6ea3209d2dc378ba39cbaf5a74bf6b9c5aebda452d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4eb9b936c2fb7fade00cbd6ea3209d2dc378ba39cbaf5a74bf6b9c5aebda452d.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS029377F6\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2068
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1868
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1220
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1844
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c 61de97674ddca_Wed0880311af5e2.exe
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1636
          • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97674ddca_Wed0880311af5e2.exe
            61de97674ddca_Wed0880311af5e2.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1512
            • C:\Windows\SysWOW64\control.exe
              "C:\Windows\System32\control.exe" .\JeEf.M
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2320
              • C:\Windows\SysWOW64\rundll32.exe
                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\JeEf.M
                7⤵
                • System Location Discovery: System Language Discovery
                PID:332
                • C:\Windows\system32\RunDll32.exe
                  C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\JeEf.M
                  8⤵
                    PID:772
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\JeEf.M
                      9⤵
                      • Blocklisted process makes network request
                      • System Location Discovery: System Language Discovery
                      PID:1156
                      • C:\Users\Admin\AppData\Local\Temp\f78a19c.exe
                        "C:\Users\Admin\AppData\Local\Temp\f78a19c.exe"
                        10⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2544
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 656
                          11⤵
                          • Program crash
                          PID:2332
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 61de97688abea_Wed08c4462e24.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2444
            • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97688abea_Wed08c4462e24.exe
              61de97688abea_Wed08c4462e24.exe
              5⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:1672
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 61de976932bf3_Wed08a22ddfdaa.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2044
            • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976932bf3_Wed08a22ddfdaa.exe
              61de976932bf3_Wed08a22ddfdaa.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:856
              • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976932bf3_Wed08a22ddfdaa.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976932bf3_Wed08a22ddfdaa.exe" -u
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1948
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 61de976975c21_Wed0822b6847.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1740
            • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976975c21_Wed0822b6847.exe
              61de976975c21_Wed0822b6847.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1952
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /im "61de976975c21_Wed0822b6847.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976975c21_Wed0822b6847.exe" & exit
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2556
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im "61de976975c21_Wed0822b6847.exe" /f
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2608
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 61de976bb4dc6_Wed08184306ce.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2656
            • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976bb4dc6_Wed08184306ce.exe
              61de976bb4dc6_Wed08184306ce.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1156
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 272
                6⤵
                • Program crash
                PID:2256
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 61de976cb6fa4_Wed08802a200.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2100
            • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976cb6fa4_Wed08802a200.exe
              61de976cb6fa4_Wed08802a200.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1736
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 61de976d080bb_Wed0867369d933.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:584
            • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976d080bb_Wed0867369d933.exe
              61de976d080bb_Wed0867369d933.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1440
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2804
              • C:\Users\Admin\AppData\Local\Temp\61de976d080bb_Wed0867369d933.exe
                C:\Users\Admin\AppData\Local\Temp\61de976d080bb_Wed0867369d933.exe
                6⤵
                • Executes dropped EXE
                PID:3016
              • C:\Users\Admin\AppData\Local\Temp\61de976d080bb_Wed0867369d933.exe
                C:\Users\Admin\AppData\Local\Temp\61de976d080bb_Wed0867369d933.exe
                6⤵
                • Executes dropped EXE
                PID:1228
              • C:\Users\Admin\AppData\Local\Temp\61de976d080bb_Wed0867369d933.exe
                C:\Users\Admin\AppData\Local\Temp\61de976d080bb_Wed0867369d933.exe
                6⤵
                • Executes dropped EXE
                PID:2760
              • C:\Users\Admin\AppData\Local\Temp\61de976d080bb_Wed0867369d933.exe
                C:\Users\Admin\AppData\Local\Temp\61de976d080bb_Wed0867369d933.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2704
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 61de976eb920b_Wed08ba1d6ac.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1664
            • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976eb920b_Wed08ba1d6ac.exe
              61de976eb920b_Wed08ba1d6ac.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2852
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 1460
                6⤵
                • Program crash
                PID:2536
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 61de976fc064f_Wed08ab67d1.exe
            4⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2292
            • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976fc064f_Wed08ab67d1.exe
              61de976fc064f_Wed08ab67d1.exe
              5⤵
              • Executes dropped EXE
              PID:696
              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2576
              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1560
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 696 -s 480
                6⤵
                  PID:2692
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c 61de9770b0458_Wed082ee61f.exe
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1244
              • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de9770b0458_Wed082ee61f.exe
                61de9770b0458_Wed082ee61f.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3024
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c 61de9771b7a26_Wed08c0835ea59.exe
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2748
              • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de9771b7a26_Wed08c0835ea59.exe
                61de9771b7a26_Wed08c0835ea59.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2952
                • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de9771b7a26_Wed08c0835ea59.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de9771b7a26_Wed08c0835ea59.exe
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2708
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c 61de97b264446_Wed08a2ba1462b.exe
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1888
              • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b264446_Wed08a2ba1462b.exe
                61de97b264446_Wed08a2ba1462b.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2400
                • C:\Users\Admin\AppData\Local\Temp\is-1ODM1.tmp\61de97b264446_Wed08a2ba1462b.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-1ODM1.tmp\61de97b264446_Wed08a2ba1462b.tmp" /SL5="$7015A,140765,56832,C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b264446_Wed08a2ba1462b.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:1928
                  • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b264446_Wed08a2ba1462b.exe
                    "C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b264446_Wed08a2ba1462b.exe" /SILENT
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1708
                    • C:\Users\Admin\AppData\Local\Temp\is-CQK13.tmp\61de97b264446_Wed08a2ba1462b.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-CQK13.tmp\61de97b264446_Wed08a2ba1462b.tmp" /SL5="$40186,140765,56832,C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b264446_Wed08a2ba1462b.exe" /SILENT
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: GetForegroundWindowSpam
                      PID:1588
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c 61de97b5aba21_Wed085151cd67c.exe /mixtwo
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1896
              • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b5aba21_Wed085151cd67c.exe
                61de97b5aba21_Wed085151cd67c.exe /mixtwo
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:1408
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 484
                  6⤵
                  • Program crash
                  PID:2904
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c 61de97b7d138f_Wed08265125ec1f.exe
              4⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:320
              • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b7d138f_Wed08265125ec1f.exe
                61de97b7d138f_Wed08265125ec1f.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2532
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2584
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2020
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2884 -s 480
              4⤵
              • Program crash
              PID:2168

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\11111.exe
        Filesize

        458KB

        MD5

        ba3a98e2a1faacf0ad668b4e9582a109

        SHA1

        1160c029a6257f776a6ed1cfdc09ae158d613ae3

        SHA256

        8165138265a2bf60d2edd69662c399bdbf1426108e98c5dfff5933168eba33f5

        SHA512

        d255da482ad2e9fa29b84676028c21683b0df7663113e2b0b7c6ff07c9fb8995e81a589e6c8d157ce33c1f266ac12a512821894159eee37dbb53a1d3ae6d6825

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\11111.exe
        Filesize

        391KB

        MD5

        7165e9d7456520d1f1644aa26da7c423

        SHA1

        177f9116229a021e24f80c4059999c4c52f9e830

        SHA256

        40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67

        SHA512

        fe80996a7f5c64815c19db1fa582581aa1934ea8d1050e686b4f65bcdd000df1decdf711e0e4b1de8a2aa4fcb1ac95cebb0316017c42e80d8386bd3400fcaecb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97688abea_Wed08c4462e24.exe
        Filesize

        8KB

        MD5

        8cb3f6ba5e7b3b4d71162a0846baaebd

        SHA1

        19543ffebd39ca3ed9296bfa127d04d4b00e422b

        SHA256

        a25bd95aeb2115ef24d3545fc11150200f567027c0673daf0bbeede99a651b4a

        SHA512

        451e5f10d4d9faccc03f529b89cd674a64f2157b0c58792165290ac65f590b03d4fc04820e48cd07431168e11c31c2090d3d68264b95277ad3c3f3df765967e1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976932bf3_Wed08a22ddfdaa.exe
        Filesize

        312KB

        MD5

        e2c982d6178375365eb7977c873b3a63

        SHA1

        f86b9f418a01fdb93018d10ad289f79cfa8a72ae

        SHA256

        d4b90392cc143ffe8cc6ec13a76f46280ebd1568c4426c5f7779abdc8f1804f6

        SHA512

        83c25a01288cc35d2c99cc3176b3bf3b10d940141093f7a160a843a8e330315066c4751a423df2147f6f2def01332dbcfe539b469a74de4c2605d74ed9c39f1d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976975c21_Wed0822b6847.exe
        Filesize

        364KB

        MD5

        98eda337c336dd1417f9660dcf63b2bf

        SHA1

        81618885b387d28133aaa1c98ded4c0570f4c56c

        SHA256

        2f11291c6d30277f01d1cd69ee33b807c90f9d6e9df579fe82651d52856ede37

        SHA512

        4d73a988b819b8728fb02f06365655246ff76704f460dc7732305bfc3e93c3c34179163c05a39869a15fb1564695b215ccdb826364ea0809d60ac12259432a3d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976bb4dc6_Wed08184306ce.exe
        Filesize

        311KB

        MD5

        a9fb80476f6d6c1cc890efcf9cadad66

        SHA1

        01121b7efed911a191bca496b9d87aa7a97608c7

        SHA256

        6541daf47c981aa3acecc5e58c1259a41ad7ce3773bc99a8c386458057bab02c

        SHA512

        031bbe595be2a5f800e9656458e731b3419d390b25c1b712b9afb9d5277a550a7ccd7efa5262aa0ff3e8361141001488d9897d9c4cae3b2a7a9cfac92cc21952

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976d080bb_Wed0867369d933.exe
        Filesize

        1.6MB

        MD5

        8e8f9ec2380e6bec8eddde2ed5640119

        SHA1

        05ba1959ac3c31d46b5707c2a98ec379e58ac0ec

        SHA256

        723e373934071cace27bebd6c8a8e3d72d96f84bf27e39b726cb28d731628ec5

        SHA512

        4aedcc14aeb3822b4c65055ff92f136713340809d2d9febca2e24583b8a9f20801eb954918bbf2952f06da31eef9757827a1725df2af1b69883ac9c93c69767b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976eb920b_Wed08ba1d6ac.exe
        Filesize

        116KB

        MD5

        243e257ab5a5db0e1b249bdc2abc4cfb

        SHA1

        24fa6eee12729ab616b9d90dee2ea07d52d3e890

        SHA256

        3382b220421a7f7afa30d6936da856741c278167b1e67db70a1b5be4894d8f80

        SHA512

        a2e37412b5fa1db2a97298d9b0368214d8f0d6a0f190bf73ef63f0a6c11d25ade16376355f5059c94a9eba544201100c7089cb952ee37456aeca21d618561ef6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de976fc064f_Wed08ab67d1.exe
        Filesize

        2.0MB

        MD5

        29fa0d00300d275c04b2d0cc3b969c57

        SHA1

        329b7fbe6ba9ceca9507af8adec6771799c2e841

        SHA256

        28314e224dcbae977cbf7dec0cda849e4a56cec90b3568a29b6bbd9234b895aa

        SHA512

        4925a7e5d831ebc1da9a6f7e77f5022e83f7f01032d102a41dd9e33a4df546202b3b27effb912aa46e5b007bda11238e1fc67f8c74ddac4993a6ee108a6cd411

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de9770b0458_Wed082ee61f.exe
        Filesize

        757KB

        MD5

        b9df5d3b6bd01a094aedade0e863f505

        SHA1

        a594649d49f2fd727aec64dff6a6dc3f8bcb6cdf

        SHA256

        34fd9f0ab92fbe49aea7ae994c41de246033e46f435ad817f2fa9ad6ff6267d8

        SHA512

        6c0baf1aa021f9f024146e11028ba1603c2f3b7e975a6a5e682545ab5e22b1e4580ed873fb975e500295225fc52b7b16dedabe6fa457769160d2618013e15186

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de9771b7a26_Wed08c0835ea59.exe
        Filesize

        527KB

        MD5

        3e52b9d96ebb916e79769c0ed601bb06

        SHA1

        f12d72f429e4f6126efe3aab708d057e761bd53c

        SHA256

        114613b6e775967d70c998abbf651018a21acbd9ea84dd0f7582ead6a9f07289

        SHA512

        ab981251eb64fd4616d8c3278df3cdcebe93f86cc9382adb4967869b83a3f7e3315449e2f3c7edba33b55f15ead7d0a78d39f9a7bc48901904e6ac3c5e4b9f71

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b264446_Wed08a2ba1462b.exe
        Filesize

        381KB

        MD5

        996061fe21353bf63874579cc6c090cc

        SHA1

        eeaf5d66e0ff5e9ddad02653c5bf6af5275e47e9

        SHA256

        b9dad89b3de1d7f9a4b73a5d107c74f716a6e2e89d653c48ab47108b37ad699a

        SHA512

        042ea077acfc0dff8684a5eb304af15177c4e6f54c774471b8091669b1ab16833894ca7a52917f8a6bbeacbb6532db521cea61d70ac4c5c992cb4896083d6c93

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b5aba21_Wed085151cd67c.exe
        Filesize

        417KB

        MD5

        e8e0de01043b54d6ce2de2c3752dc3fc

        SHA1

        b6c6ff9860dbe3b2ad20d097a3cb9c650e405a7d

        SHA256

        63df07d507d5b3b5ec8d6d3612be4961ac580fee626225ed5d96b2e2aa42b7be

        SHA512

        eee15bc75ea631b061a9be06ab64e8962aa360a00c1e8e86dc29db151f26568ba07a6de1b1919a184e70ca3e199109f330e7a72e3622b9292809cebdcc7cb75a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\61de97b7d138f_Wed08265125ec1f.exe
        Filesize

        1.4MB

        MD5

        00be17b3ea546cf8979f85a96984ec67

        SHA1

        d9b65a136298371e7f03e36450e80ce17be73822

        SHA256

        313bbb16f06392209ad4aeb7752dd74a44bfd0424e69265e8f7f91b07ffa937c

        SHA512

        8131b6bcbfb1febdc9b9c4b3dd5395ea45d57184c869e091da1618b2b7f9445f9c06b451433c58a5a2711a3ce10fe4246a405d18fdeefb2f4a319c496b0a0794

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\libcurl.dll
        Filesize

        218KB

        MD5

        d09be1f47fd6b827c81a4812b4f7296f

        SHA1

        028ae3596c0790e6d7f9f2f3c8e9591527d267f7

        SHA256

        0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

        SHA512

        857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zS029377F6\libgcc_s_dw2-1.dll
        Filesize

        113KB

        MD5

        9aec524b616618b0d3d00b27b6f51da1

        SHA1

        64264300801a353db324d11738ffed876550e1d3

        SHA256

        59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

        SHA512

        0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\CabFCE5.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar50C0.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\f78a19c.exe
        Filesize

        11KB

        MD5

        620bda3df817bff8deb38758d1dc668c

        SHA1

        9933523941851b42047f2b7a1324eb8daa8fb1ff

        SHA256

        b74d7ff45768a1ee6f267e895de3e46cca505edf205563ef3f7db827f38363b3

        SHA512

        bc9e932860f63090bab251057bc1fd6875c410c2358321eaa74fccc117561b91e4ce6b24d5e7bb13dc44732ae151b7c33fe201acbb5af689d7f2d248dfb8c568

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-09GU2.tmp\_isetup\_shfoldr.dll
        Filesize

        22KB

        MD5

        92dc6ef532fbb4a5c3201469a5b5eb63

        SHA1

        3e89ff837147c16b4e41c30d6c796374e0b8e62c

        SHA256

        9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

        SHA512

        9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-09GU2.tmp\idp.dll
        Filesize

        216KB

        MD5

        b37377d34c8262a90ff95a9a92b65ed8

        SHA1

        faeef415bd0bc2a08cf9fe1e987007bf28e7218d

        SHA256

        e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f

        SHA512

        69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-CQK13.tmp\61de97b264446_Wed08a2ba1462b.tmp
        Filesize

        691KB

        MD5

        9303156631ee2436db23827e27337be4

        SHA1

        018e0d5b6ccf7000e36af30cebeb8adc5667e5fa

        SHA256

        bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4

        SHA512

        9fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NMN4APZX43JAFVUPT6XU.temp
        Filesize

        7KB

        MD5

        bf35594cd4cfb98d613dfaaa362f277c

        SHA1

        5e8d7bcc967a52bb268094b9edb915bf8c916252

        SHA256

        e0daf2fa7b96258ac08375a59555bc2411b96f040fe551e2e30ec34c5540b7ea

        SHA512

        c4b14da69e1be751e6297794b62a1ee8ff36b486634da499054c0531068aee3ce7b081227276931d56dfbef74150b195df1b25351ac1ae9757eb0575c0688e1c

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zS029377F6\61de97674ddca_Wed0880311af5e2.exe
        Filesize

        2.0MB

        MD5

        b17c27ce1b413fbcf5bedc16fd822d3f

        SHA1

        dcfaf9401aff2353285b47506cb42e3563059359

        SHA256

        cf937b910bcc349c6534ae3563c7c9512cd8819f847494efb2a3025bccff9f14

        SHA512

        c4f91cbef79961c8cf7bf83e7f7bf53b40d0339e4b170c20da1c671f673fc1f35067dcd0e35d6a979f76873a98d2100c967ea48aee3afc03d4184ab2a043e0da

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zS029377F6\61de976cb6fa4_Wed08802a200.exe
        Filesize

        136KB

        MD5

        14d0d4049bb131fb31dcb7b3736661e7

        SHA1

        927d885f395bc5ae04e442b9a56a6bd3908d1447

        SHA256

        427ddd764ac020fc8a5f4a164cc8e1e282e8f53fc5ad34256b2aeb7fe8d68ca5

        SHA512

        bf0bf5337e2c2815f5f93f6006f2ac2742bb6d60324c7f3eedfbbe041c41ae9b2da1956417c467f668d71fc93c4835d4a81c961c04cbb286c887b99e82bb0994

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zS029377F6\libcurlpp.dll
        Filesize

        54KB

        MD5

        e6e578373c2e416289a8da55f1dc5e8e

        SHA1

        b601a229b66ec3d19c2369b36216c6f6eb1c063e

        SHA256

        43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

        SHA512

        9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zS029377F6\libstdc++-6.dll
        Filesize

        647KB

        MD5

        5e279950775baae5fea04d2cc4526bcc

        SHA1

        8aef1e10031c3629512c43dd8b0b5d9060878453

        SHA256

        97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

        SHA512

        666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zS029377F6\libwinpthread-1.dll
        Filesize

        69KB

        MD5

        1e0d62c34ff2e649ebc5c372065732ee

        SHA1

        fcfaa36ba456159b26140a43e80fbd7e9d9af2de

        SHA256

        509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

        SHA512

        3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

        Download Submit

      • \Users\Admin\AppData\Local\Temp\7zS029377F6\setup_install.exe
        Filesize

        2.1MB

        MD5

        49aa22a74be9906940779cf37450ecd5

        SHA1

        257cb5d6c49acaa3161d6e24be21410f6f7c538b

        SHA256

        a99951ec6d87a441c397fdabce3557c437873aef61eee35f4b459281e6bf5ac3

        SHA512

        1e612fd9e54d60acafb93cdfdf48c871efcbd737b606e9a350b8333a162ab5f746170c7361eabaf7024569eeefc4379ddb41e49021bb22635f9a371dd78f3bca

        Download Submit

      • \Users\Admin\AppData\Local\Temp\setup_installer.exe
        Filesize

        5.9MB

        MD5

        fc3d693298f610faa5869d6740ec9b23

        SHA1

        2c4b72aa5678789b3b96a335aa239c1c37872125

        SHA256

        2d596cc06b63ba36208914b48a365c0609f7c4d0c73b7cf1afd42edcbbfca56f

        SHA512

        284a2c54d27845347af999ce5409bcd4060f2bd2b6c2a6cb1e702578cb29f6bbc45099b42e72d05c40d74feb8eab9d986a08c53e6ca0399245188718b8e594bc

        Download Submit

      • memory/332-260-0x0000000000460000-0x00000000004FF000-memory.dmp

        Filesize

        636KB

        Download

      • memory/332-182-0x0000000002920000-0x0000000003920000-memory.dmp

        Filesize

        16.0MB

        Download

      • memory/332-256-0x000000002D8B0000-0x000000002D963000-memory.dmp

        Filesize

        716KB

        Download

      • memory/332-271-0x0000000002920000-0x0000000003920000-memory.dmp

        Filesize

        16.0MB

        Download

      • memory/332-257-0x0000000000460000-0x00000000004FF000-memory.dmp

        Filesize

        636KB

        Download

      • memory/1156-183-0x0000000000400000-0x000000000056A000-memory.dmp

        Filesize

        1.4MB

        Download

      • memory/1244-143-0x00000000029A0000-0x0000000002B74000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/1408-252-0x0000000000400000-0x0000000000585000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/1408-276-0x0000000000400000-0x0000000000585000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/1440-168-0x00000000000D0000-0x0000000000270000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/1440-493-0x0000000004EC0000-0x0000000004F18000-memory.dmp

        Filesize

        352KB

        Download

      • memory/1560-268-0x0000000000400000-0x000000000047C000-memory.dmp

        Filesize

        496KB

        Download

      • memory/1588-270-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

        Download

      • memory/1672-129-0x00000000000B0000-0x00000000000B8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1708-269-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/1708-166-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/1928-164-0x0000000000400000-0x00000000004BD000-memory.dmp

        Filesize

        756KB

        Download

      • memory/1952-275-0x0000000000400000-0x0000000000463000-memory.dmp

        Filesize

        396KB

        Download

      • memory/2400-165-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2400-138-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2544-606-0x00000000012B0000-0x00000000012B8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2704-515-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2708-224-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2708-222-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2708-220-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2708-232-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2708-230-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2708-229-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2708-228-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2708-226-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2884-246-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2884-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2884-237-0x000000006EB40000-0x000000006EB63000-memory.dmp

        Filesize

        140KB

        Download

      • memory/2884-236-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2884-235-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2884-234-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

        Download

      • memory/2884-233-0x0000000000400000-0x000000000051C000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2884-71-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2884-74-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2884-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2884-248-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2884-247-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2884-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2884-244-0x000000006EB40000-0x000000006EB63000-memory.dmp

        Filesize

        140KB

        Download

      • memory/2884-241-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

        Download

      • memory/2884-240-0x0000000000400000-0x000000000051C000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2884-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2884-83-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

        Download

      • memory/2884-238-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2884-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2884-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2884-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2884-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2884-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2952-150-0x00000000012D0000-0x000000000135A000-memory.dmp

        Filesize

        552KB

        Download

      • memory/3024-251-0x0000000000400000-0x00000000005D4000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/3024-149-0x0000000076AB0000-0x0000000076B5C000-memory.dmp

        Filesize

        688KB

        Download

      • memory/3024-148-0x0000000074F90000-0x0000000074FD7000-memory.dmp

        Filesize

        284KB

        Download

      • memory/3024-254-0x0000000074F90000-0x0000000074FD7000-memory.dmp

        Filesize

        284KB

        Download

      • memory/3024-255-0x0000000076AB0000-0x0000000076B5C000-memory.dmp

        Filesize

        688KB

        Download

      • memory/3024-146-0x00000000003F0000-0x00000000003F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3024-339-0x0000000000780000-0x000000000078A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3024-147-0x0000000000400000-0x00000000005D4000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/3024-145-0x0000000000EB0000-0x0000000001084000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/3024-551-0x0000000000400000-0x00000000005D4000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/3024-144-0x0000000000400000-0x00000000005D4000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/3024-142-0x0000000000400000-0x00000000005D4000-memory.dmp

        Filesize

        1.8MB

        Download