Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

ec8cd0b52b...57.exe

windows7-x64

3

ec8cd0b52b...57.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/01/2025, 03:49 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe

  • Size

    1.1MB

  • MD5

    47bd83617560c80c7e805b546ea2a258

  • SHA1

    09daba42fcaba0481d72e26a201d4eb442a842b9

  • SHA256

    ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557

  • SHA512

    1d916bb6927680a1b65c414a075caf2302a5375cad9a5d5be941a56c85a1f5996435a6dbdce8614964edd325b4530a926e506a043ebe5e8f942efd152a0f25b3

  • SSDEEP

    24576:vBg/P8B5+B25I3e3LxT3huxT5TXyV7Jir8XLLAO+:vBS0425IO1xu15ToEobL2

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
        "C:\Users\Admin\AppData\Local\Temp\ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4352
      • C:\Users\Admin\AppData\Local\Temp\ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
        "C:\Users\Admin\AppData\Local\Temp\ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:4380

    Network

    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      traygullibalkerj.click
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      traygullibalkerj.click
      IN A
      Response
      traygullibalkerj.click
      IN A
      104.21.112.1
      traygullibalkerj.click
      IN A
      104.21.32.1
      traygullibalkerj.click
      IN A
      104.21.16.1
      traygullibalkerj.click
      IN A
      104.21.64.1
      traygullibalkerj.click
      IN A
      104.21.96.1
      traygullibalkerj.click
      IN A
      104.21.80.1
      traygullibalkerj.click
      IN A
      104.21.48.1
    • flag-us
      POST
      https://traygullibalkerj.click/api
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      104.21.112.1:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: traygullibalkerj.click
      Response
      HTTP/1.1 200 OK
      Date: Sat, 04 Jan 2025 03:50:11 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=lkrcpffuai166orp9hu9va0ggk; expires=Tue, 29 Apr 2025 21:36:50 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zV%2FjfqtYulXEOUiAOmyqeIWaP8DdkMj9ZBaJr1Rzbnus9eyIsTPb9OAaCCA84g1YIkMzcr0xNf%2Bvz4pAKj9Yi2%2BymrUK%2FJMNYZQeMxJXckKcmK7uZkuEh0NUE4bqbLM0gqCUj304k371"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fc843538fc7bd6f-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=36593&min_rtt=33934&rtt_var=11700&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3315&recv_bytes=617&delivery_rate=90342&cwnd=234&unsent_bytes=0&cid=59540d8928062903&ts=265&x=0"
    • flag-us
      DNS
      nearycrepso.shop
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      nearycrepso.shop
      IN A
      Response
    • flag-us
      DNS
      abruptyopsn.shop
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      abruptyopsn.shop
      IN A
      Response
      abruptyopsn.shop
      IN A
      104.21.112.1
      abruptyopsn.shop
      IN A
      104.21.96.1
      abruptyopsn.shop
      IN A
      104.21.16.1
      abruptyopsn.shop
      IN A
      104.21.32.1
      abruptyopsn.shop
      IN A
      104.21.64.1
      abruptyopsn.shop
      IN A
      104.21.48.1
      abruptyopsn.shop
      IN A
      104.21.80.1
    • flag-us
      POST
      https://abruptyopsn.shop/api
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      104.21.112.1:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: abruptyopsn.shop
      Response
      HTTP/1.1 200 OK
      Date: Sat, 04 Jan 2025 03:50:12 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=0vhpovrsjr0pv5i7ce5kt4eu79; expires=Tue, 29 Apr 2025 21:36:51 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2S2Fns9VbOufP4SF7Vxqxx3vWrFSQn5YhwZPIao9bvjK9B3ORI40q4s6dMOkChO7gLRPqvFmG4UfKnr%2Bt0%2BqMXN987ereRoECiKRJIj0CSovLKbcbhYLnrA1ZGcKC6%2F96aD%2B"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fc84355cde1cd14-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=28680&min_rtt=26492&rtt_var=8961&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3511&recv_bytes=605&delivery_rate=102446&cwnd=253&unsent_bytes=0&cid=b3f11b7935c8e321&ts=248&x=0"
    • flag-us
      DNS
      wholersorie.shop
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      wholersorie.shop
      IN A
      Response
      wholersorie.shop
      IN A
      104.21.41.51
      wholersorie.shop
      IN A
      172.67.160.114
    • flag-us
      POST
      https://wholersorie.shop/api
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      104.21.41.51:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: wholersorie.shop
      Response
      HTTP/1.1 200 OK
      Date: Sat, 04 Jan 2025 03:50:12 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=lnko67cto86mi3fnja3kok1ik5; expires=Tue, 29 Apr 2025 21:36:51 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QxUiKzxOJ40rJKWdOROMU98JStn0qPIIWAyVv%2BGPnPVYKd7zI0xr3%2Fjtk9wGLoVFWH24HUhRnxQF1lHgJv75l5SOpp16JTlbVi6ro2peBwpRK4uNy4035gPdrC%2B1wIFgaEDk"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fc84357cb043859-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=27118&min_rtt=26223&rtt_var=7068&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3300&recv_bytes=605&delivery_rate=134494&cwnd=253&unsent_bytes=0&cid=9b04f5ebd69db3af&ts=244&x=0"
    • flag-us
      DNS
      1.112.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.112.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      framekgirus.shop
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      framekgirus.shop
      IN A
      Response
      framekgirus.shop
      IN A
      172.67.179.160
      framekgirus.shop
      IN A
      104.21.18.19
    • flag-us
      POST
      https://framekgirus.shop/api
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      172.67.179.160:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: framekgirus.shop
      Response
      HTTP/1.1 200 OK
      Date: Sat, 04 Jan 2025 03:50:12 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=ev0enqgsmub7nq627vj8qp6urb; expires=Tue, 29 Apr 2025 21:36:51 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FynI4Y3IF3accmmGud4%2FYwWIHyn3X3kgCnzvAcyRJRQ6W%2Blxzr1qFWwUU6Z9VI4pVvf9b%2Fl5Phi%2BRuP5XWmAufOj1GU8fRJHNzG%2FB19J9CKayhw8PhyOXrcoICC2ICwF5gXP"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fc84359ef7b94df-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=27064&min_rtt=25960&rtt_var=7342&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3294&recv_bytes=605&delivery_rate=132800&cwnd=252&unsent_bytes=0&cid=0998c65d9d32fc2e&ts=215&x=0"
    • flag-us
      DNS
      tirepublicerj.shop
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      tirepublicerj.shop
      IN A
      Response
      tirepublicerj.shop
      IN A
      104.21.64.1
      tirepublicerj.shop
      IN A
      104.21.112.1
      tirepublicerj.shop
      IN A
      104.21.80.1
      tirepublicerj.shop
      IN A
      104.21.96.1
      tirepublicerj.shop
      IN A
      104.21.48.1
      tirepublicerj.shop
      IN A
      104.21.32.1
      tirepublicerj.shop
      IN A
      104.21.16.1
    • flag-us
      POST
      https://tirepublicerj.shop/api
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      104.21.64.1:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: tirepublicerj.shop
      Response
      HTTP/1.1 200 OK
      Date: Sat, 04 Jan 2025 03:50:13 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=4rgucjcao704i79a1qdl5m2rmj; expires=Tue, 29 Apr 2025 21:36:52 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s%2BkZ4UxzasdXmecH%2BtvuYcJqUBobIAKrS3Y7M%2BUU2bVZVhk%2BfaeZdCkDqUS1kFRApmW%2F6P%2BbfLpG%2BF3bnfnT00S7AYK%2F7%2FUsRXZkFydS%2B0wfjet78vt24mFSJDIgB6bVvJxcOsc%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fc8435bda7acdad-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=27715&min_rtt=26199&rtt_var=8222&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3301&recv_bytes=609&delivery_rate=130176&cwnd=253&unsent_bytes=0&cid=d9cf7c83bb07ab94&ts=224&x=0"
    • flag-us
      DNS
      noisycuttej.shop
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      noisycuttej.shop
      IN A
      Response
      noisycuttej.shop
      IN A
      104.21.71.146
      noisycuttej.shop
      IN A
      172.67.170.178
    • flag-us
      POST
      https://noisycuttej.shop/api
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      104.21.71.146:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: noisycuttej.shop
      Response
      HTTP/1.1 200 OK
      Date: Sat, 04 Jan 2025 03:50:13 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=pd7lelo1hfc65ajm8qdg9p0d4q; expires=Tue, 29 Apr 2025 21:36:52 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rybOQSTwBg5suGSh2nKxJC4adfiBPNB2Mz9KeCTim%2Ffr9EAqdjqK16irnWtdrdzsfv3ih9nyr7nIFJc4fZiZ1AwB7SlUs5Xn4A1O1ku05BdS7utEji3XdSboePRLhDzhuZpO"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fc8435dbc5493fa-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=26906&min_rtt=26057&rtt_var=6764&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3298&recv_bytes=605&delivery_rate=139017&cwnd=232&unsent_bytes=0&cid=cacb386f80f272d9&ts=231&x=0"
    • flag-us
      DNS
      160.179.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      160.179.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      51.41.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      51.41.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.64.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.64.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      rabidcowse.shop
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      rabidcowse.shop
      IN A
      Response
      rabidcowse.shop
      IN A
      104.21.7.224
      rabidcowse.shop
      IN A
      172.67.156.127
    • flag-us
      POST
      https://rabidcowse.shop/api
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      104.21.7.224:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: rabidcowse.shop
      Response
      HTTP/1.1 200 OK
      Date: Sat, 04 Jan 2025 03:50:13 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=g6n1fklsdirbgp5e8big7batac; expires=Tue, 29 Apr 2025 21:36:52 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ULzV0%2BtZ90hLh6w6FJuZ%2BpZIAw7XRfNEWUaME28v9UP%2BwUT1SyoqFfv2LxeKE6Cn6L9pGS6C38gwBB4bIFHgT%2BKnjtwdiAVQk1odh4zs3qsVx5IipcIooU3Tuw0E86GUR6o%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fc8435fc83594bd-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=27553&min_rtt=25973&rtt_var=8031&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3295&recv_bytes=603&delivery_rate=139103&cwnd=235&unsent_bytes=0&cid=a99f879cb6c501c3&ts=243&x=0"
    • flag-us
      DNS
      cloudewahsj.shop
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      cloudewahsj.shop
      IN A
      Response
      cloudewahsj.shop
      IN A
      104.21.112.1
      cloudewahsj.shop
      IN A
      104.21.32.1
      cloudewahsj.shop
      IN A
      104.21.48.1
      cloudewahsj.shop
      IN A
      104.21.64.1
      cloudewahsj.shop
      IN A
      104.21.16.1
      cloudewahsj.shop
      IN A
      104.21.96.1
      cloudewahsj.shop
      IN A
      104.21.80.1
    • flag-us
      POST
      https://cloudewahsj.shop/api
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      104.21.112.1:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: cloudewahsj.shop
      Response
      HTTP/1.1 200 OK
      Date: Sat, 04 Jan 2025 03:50:14 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=72rnsne9vbc6d2bhjpt261d7bi; expires=Tue, 29 Apr 2025 21:36:53 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n%2FcHru46d8zjjwxYyoZebykaTSfGfBLDPUncqfFeOXRpEc%2FsOyRhBk6lLhshviySeSwrvazOg%2F6ggyKDCMA4NlyA7Fwg5uU1CCgxBFktDxWTS05dDr9ZupRWH8n80fs%2FOt7d"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fc84361dee78871-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=27262&min_rtt=26299&rtt_var=7156&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3293&recv_bytes=605&delivery_rate=137887&cwnd=253&unsent_bytes=0&cid=2b392eb15a27a73f&ts=214&x=0"
    • flag-us
      DNS
      steamcommunity.com
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      8.8.8.8:53
      Request
      steamcommunity.com
      IN A
      Response
      steamcommunity.com
      IN A
      23.214.143.155
    • flag-gb
      GET
      https://steamcommunity.com/profiles/76561199724331900
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      Remote address:
      23.214.143.155:443
      Request
      GET /profiles/76561199724331900 HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Host: steamcommunity.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Content-Type: text/html; charset=UTF-8
      Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
      Expires: Mon, 26 Jul 1997 05:00:00 GMT
      Cache-Control: no-cache
      Date: Sat, 04 Jan 2025 03:50:14 GMT
      Content-Length: 25984
      Connection: keep-alive
      Set-Cookie: sessionid=662222753b7c01aa884b84e5; Path=/; Secure; SameSite=None
      Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
    • flag-us
      DNS
      146.71.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      146.71.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      224.7.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      224.7.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      155.143.214.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      155.143.214.23.in-addr.arpa
      IN PTR
      Response
      155.143.214.23.in-addr.arpa
      IN PTR
      a23-214-143-155deploystaticakamaitechnologiescom
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      60.153.16.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      60.153.16.2.in-addr.arpa
      IN PTR
      Response
      60.153.16.2.in-addr.arpa
      IN PTR
      a2-16-153-60deploystaticakamaitechnologiescom
    • flag-us
      DNS
      8.153.16.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.153.16.2.in-addr.arpa
      IN PTR
      Response
      8.153.16.2.in-addr.arpa
      IN PTR
      a2-16-153-8deploystaticakamaitechnologiescom
    • flag-us
      DNS
      29.243.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      29.243.111.52.in-addr.arpa
      IN PTR
      Response
    • 104.21.112.1:443
      https://traygullibalkerj.click/api
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://traygullibalkerj.click/api

      HTTP Response

      200
    • 104.21.112.1:443
      https://abruptyopsn.shop/api
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      1.0kB
       5.1kB
       9
      9

      HTTP Request

      POST https://abruptyopsn.shop/api

      HTTP Response

      200
    • 104.21.41.51:443
      https://wholersorie.shop/api
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://wholersorie.shop/api

      HTTP Response

      200
    • 172.67.179.160:443
      https://framekgirus.shop/api
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://framekgirus.shop/api

      HTTP Response

      200
    • 104.21.64.1:443
      https://tirepublicerj.shop/api
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://tirepublicerj.shop/api

      HTTP Response

      200
    • 104.21.71.146:443
      https://noisycuttej.shop/api
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://noisycuttej.shop/api

      HTTP Response

      200
    • 104.21.7.224:443
      https://rabidcowse.shop/api
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      999 B
       4.9kB
       9
      9

      HTTP Request

      POST https://rabidcowse.shop/api

      HTTP Response

      200
    • 104.21.112.1:443
      https://cloudewahsj.shop/api
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://cloudewahsj.shop/api

      HTTP Response

      200
    • 23.214.143.155:443
      https://steamcommunity.com/profiles/76561199724331900
      tls, http
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      1.3kB
       33.2kB
       17
      29

      HTTP Request

      GET https://steamcommunity.com/profiles/76561199724331900

      HTTP Response

      200
    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      14.160.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      14.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      traygullibalkerj.click
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      68 B
       180 B
       1
      1

      DNS Request

      traygullibalkerj.click

      DNS Response

      104.21.112.1
      104.21.32.1
      104.21.16.1
      104.21.64.1
      104.21.96.1
      104.21.80.1
      104.21.48.1

    • 8.8.8.8:53
      nearycrepso.shop
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      62 B
       119 B
       1
      1

      DNS Request

      nearycrepso.shop

    • 8.8.8.8:53
      abruptyopsn.shop
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      62 B
       174 B
       1
      1

      DNS Request

      abruptyopsn.shop

      DNS Response

      104.21.112.1
      104.21.96.1
      104.21.16.1
      104.21.32.1
      104.21.64.1
      104.21.48.1
      104.21.80.1

    • 8.8.8.8:53
      wholersorie.shop
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      62 B
       94 B
       1
      1

      DNS Request

      wholersorie.shop

      DNS Response

      104.21.41.51
      172.67.160.114

    • 8.8.8.8:53
      1.112.21.104.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      1.112.21.104.in-addr.arpa

    • 8.8.8.8:53
      framekgirus.shop
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      62 B
       94 B
       1
      1

      DNS Request

      framekgirus.shop

      DNS Response

      172.67.179.160
      104.21.18.19

    • 8.8.8.8:53
      tirepublicerj.shop
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      64 B
       176 B
       1
      1

      DNS Request

      tirepublicerj.shop

      DNS Response

      104.21.64.1
      104.21.112.1
      104.21.80.1
      104.21.96.1
      104.21.48.1
      104.21.32.1
      104.21.16.1

    • 8.8.8.8:53
      noisycuttej.shop
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      62 B
       94 B
       1
      1

      DNS Request

      noisycuttej.shop

      DNS Response

      104.21.71.146
      172.67.170.178

    • 8.8.8.8:53
      160.179.67.172.in-addr.arpa
      dns
      73 B
       135 B
       1
      1

      DNS Request

      160.179.67.172.in-addr.arpa

    • 8.8.8.8:53
      51.41.21.104.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      51.41.21.104.in-addr.arpa

    • 8.8.8.8:53
      1.64.21.104.in-addr.arpa
      dns
      70 B
       132 B
       1
      1

      DNS Request

      1.64.21.104.in-addr.arpa

    • 8.8.8.8:53
      rabidcowse.shop
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      61 B
       93 B
       1
      1

      DNS Request

      rabidcowse.shop

      DNS Response

      104.21.7.224
      172.67.156.127

    • 8.8.8.8:53
      cloudewahsj.shop
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      62 B
       174 B
       1
      1

      DNS Request

      cloudewahsj.shop

      DNS Response

      104.21.112.1
      104.21.32.1
      104.21.48.1
      104.21.64.1
      104.21.16.1
      104.21.96.1
      104.21.80.1

    • 8.8.8.8:53
      steamcommunity.com
      dns
      ec8cd0b52b6d8839d69c9ceb691cd5a92d183394b749c5ba354d31e124cc4557.exe
      64 B
       80 B
       1
      1

      DNS Request

      steamcommunity.com

      DNS Response

      23.214.143.155

    • 8.8.8.8:53
      146.71.21.104.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      146.71.21.104.in-addr.arpa

    • 8.8.8.8:53
      224.7.21.104.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      224.7.21.104.in-addr.arpa

    • 8.8.8.8:53
      155.143.214.23.in-addr.arpa
      dns
      73 B
       139 B
       1
      1

      DNS Request

      155.143.214.23.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      28.118.140.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      28.118.140.52.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      60.153.16.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      60.153.16.2.in-addr.arpa

    • 8.8.8.8:53
      8.153.16.2.in-addr.arpa
      dns
      69 B
       131 B
       1
      1

      DNS Request

      8.153.16.2.in-addr.arpa

    • 8.8.8.8:53
      29.243.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      29.243.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4352-30-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-52-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-2-0x0000000005140000-0x0000000005252000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/4352-22-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-20-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-58-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-66-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-64-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-62-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-60-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-56-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-54-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-28-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-50-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-48-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-46-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-44-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-42-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-40-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-38-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-36-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-32-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-1-0x00000000005C0000-0x00000000006DC000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/4352-0-0x0000000074A6E000-0x0000000074A6F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4352-6-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-18-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-16-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-14-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-12-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-10-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-8-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-26-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-4-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-34-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-24-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-3-0x0000000005140000-0x000000000524C000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4352-1185-0x0000000074A60000-0x0000000075210000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4352-1186-0x0000000074A60000-0x0000000075210000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4352-1187-0x0000000005290000-0x0000000005312000-memory.dmp

      Filesize

      520KB

      Download

    • memory/4352-1188-0x00000000050D0000-0x000000000511C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4352-1189-0x0000000005C60000-0x0000000006204000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4352-1190-0x00000000054E0000-0x0000000005534000-memory.dmp

      Filesize

      336KB

      Download

    • memory/4352-1194-0x0000000074A60000-0x0000000075210000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4352-1196-0x0000000074A60000-0x0000000075210000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4352-1200-0x0000000074A60000-0x0000000075210000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4352-1201-0x0000000074A60000-0x0000000075210000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4380-1202-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.