amadey | 3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2024, 14:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
Size 3.1MB
Sample240420-r7ve6aah88
SHA256 3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee
MD5 aafe7a7ca7b099b63dbf4519acb0a3ae
SHA1 1444e1cf228680b5876cc250b6cabbb59b2776c5
SHA512 be0d41d45501fa9460c73da7ed5ab0eeaf708e34def9a6b676ea6955b9c3f543201629bb9b3f6defdacdf25a77d16ee7a54b7776a17ecb742e841c27fa1c929e
SSDEEP 49152:FFaDRoV0y9zRtDdfSuMFqRDojzh372CqPUHppc8DxwQ9:SDj2zRtDdauMwREzh372CFppXDxwQ9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.93:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5cb1d85663.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	4936	rundll32.exe
20	3284	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5cb1d85663.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5cb1d85663.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe

Executes dropped EXE 6 IoCs

pid	Process
2220	explorha.exe
960	explorha.exe
2456	052e0f34d9.exe
4256	explorha.exe
956	5cb1d85663.exe
4996	explorha.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
Key opened	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine	5cb1d85663.exe
Key opened	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine	explorha.exe

Loads dropped DLL 3 IoCs

pid	Process
1908	rundll32.exe
4936	rundll32.exe
3284	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\052e0f34d9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000055001\\052e0f34d9.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cb1d85663.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000056001\\5cb1d85663.exe"	explorha.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002a9f5-83.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
416	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
2220	explorha.exe
960	explorha.exe
4256	explorha.exe
956	5cb1d85663.exe
4996	explorha.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorha.job	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133580982758445059"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-801878912-692986033-442676226-1000\{1897BA62-3D8C-42CD-8363-E78B6917CE9D}	chrome.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
416	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
416	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
2220	explorha.exe
2220	explorha.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
960	explorha.exe
960	explorha.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
3252	powershell.exe
3252	powershell.exe
2372	chrome.exe
2372	chrome.exe
4256	explorha.exe
4256	explorha.exe
956	5cb1d85663.exe
956	5cb1d85663.exe
4996	explorha.exe
4996	explorha.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe
Token: SeCreatePagefilePrivilege	2372	chrome.exe
Token: SeShutdownPrivilege	2372	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
416	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2456	052e0f34d9.exe
2372	chrome.exe
2456	052e0f34d9.exe
2372	chrome.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2372	chrome.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe
2456	052e0f34d9.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 2220	416	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe	80
PID 416 wrote to memory of 2220	416	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe	80
PID 416 wrote to memory of 2220	416	3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe	80
PID 2220 wrote to memory of 1908	2220	explorha.exe	81
PID 2220 wrote to memory of 1908	2220	explorha.exe	81
PID 2220 wrote to memory of 1908	2220	explorha.exe	81
PID 1908 wrote to memory of 4936	1908	rundll32.exe	82
PID 1908 wrote to memory of 4936	1908	rundll32.exe	82
PID 4936 wrote to memory of 980	4936	rundll32.exe	83
PID 4936 wrote to memory of 980	4936	rundll32.exe	83
PID 4936 wrote to memory of 3252	4936	rundll32.exe	86
PID 4936 wrote to memory of 3252	4936	rundll32.exe	86
PID 2220 wrote to memory of 2456	2220	explorha.exe	88
PID 2220 wrote to memory of 2456	2220	explorha.exe	88
PID 2220 wrote to memory of 2456	2220	explorha.exe	88
PID 2456 wrote to memory of 2372	2456	052e0f34d9.exe	89
PID 2456 wrote to memory of 2372	2456	052e0f34d9.exe	89
PID 2372 wrote to memory of 4060	2372	chrome.exe	92
PID 2372 wrote to memory of 4060	2372	chrome.exe	92
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 1516	2372	chrome.exe	93
PID 2372 wrote to memory of 2604	2372	chrome.exe	94
PID 2372 wrote to memory of 2604	2372	chrome.exe	94
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95
PID 2372 wrote to memory of 472	2372	chrome.exe	95

C:\Users\Admin\AppData\Local\Temp\3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe
"C:\Users\Admin\AppData\Local\Temp\3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:416
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1908
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:980
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\018789126929_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252
- - C:\Users\Admin\AppData\Local\Temp\1000055001\052e0f34d9.exe
    "C:\Users\Admin\AppData\Local\Temp\1000055001\052e0f34d9.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe2282ab58,0x7ffe2282ab68,0x7ffe2282ab78
        5⤵
        
        PID:4060
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:2
        5⤵
        
        PID:1516
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:8
        5⤵
        
        PID:2604
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2140 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:8
        5⤵
        
        PID:472
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:1
        5⤵
        
        PID:4896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:1
        5⤵
        
        PID:4016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4188 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:1
        5⤵
        
        PID:4376
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4388 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:1
        5⤵
        
        PID:3392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4424 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:8
        5⤵
        
        PID:4892
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:2992
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:8
        5⤵
        
        PID:2916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:8
        5⤵
        
        PID:4484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5084 --field-trial-handle=1796,i,18286383623808440741,9712707543443657841,131072 /prefetch:8
        5⤵
        
        PID:1656
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:3284
- - C:\Users\Admin\AppData\Local\Temp\1000056001\5cb1d85663.exe
    "C:\Users\Admin\AppData\Local\Temp\1000056001\5cb1d85663.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:4064

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:960

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4668

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4256

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 9cffae9bb7889e4b96594ed91d9f094999001866219e5a8f0d4d8abc6c983fa8
MD5 a8a2c1ee67a48c46a29c069c82afa6bc
SHA1 d9a85dcfd02fb80177a85d15376dc17c4ba538cc
SHA512 78e009770b18e8afdb782906aa6f92f77fd541981c1ccce7b93b015a0000b25f651d526bf8980ec7bb0ded1f113fbe572e6223206a9b4b93a3db6d066e617862
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0f3eb3a3868db8e3bcc9bd288cc80a4d181d2e262be076e752260d1c8d457679
MD5 661b2c745ed3a9a16c3d3d7773d694a6
SHA1 6d5603b8bcb88567a4f0833bbdb7f343ed1d0126
SHA512 71d03b15a8f08dc14bece9e4376064d9f2a84c692b5870a4597ea8035531c6db69a10f47c8c5780b8ea06bc95b7b8fa3b8e8e3d0312a03de01cd6347d4193d66
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 9d55ccc73d5cc047bb2132c0be789efff8a249bf717c52ee0cbf3b7ce1c5949c
MD5 65fc4dd510096067c1fbb4aa7625f336
SHA1 d72ef615025ba746096031f8574e763b239bf9da
SHA512 30b7f34cbd9636589727ea77f3d9ad1008843a770bc2725b76ee8fd83be6d7dee6f9bb668a0d85f96b6d4d9faa1fe84ebc2d554cd6391577300886a9ba40389a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 522B
SHA256 bf4cf372722a5caeac724aa17bfaab2d5804819d18d5c241e66466b168f6993c
MD5 fe6c2d25454e6a0081ddb511476aae20
SHA1 92198f32527911292887e927ff737a40b52ee17e
SHA512 f63cd29140a4c2e988bf8fde8682d966a125d48ae8b3e1b08fc23e097f0c0f6a125f799499f3555ce6d1cef7e9cc7b9bc37c1bf582c017dc270c2980dd87ad47
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 6dc7ff48f24dc0471cc298c46437079c345f5bac379ebc4a56ec78bd52ca569a
MD5 f7ca638b5b7137a8c745d76b291c8828
SHA1 97dbf36fc7182e3b64680b4b142c57ed26fabb5e
SHA512 c9ea012ee0f1d3c65418b49d0795b0ce9391eda69dd2a6a5a27063c6608e205c3227fceca31af34205f3bdf72780097cc8f1d4554809e7fff67752c0fd1a07ff
SSDEEP 192:B8XLx7l2DaJ6i8qyh+F8of79IP5tjEsXtScR:B8XLFl2etyq8279QtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 32c3b6abaceced485fc1c78dbde2597386f6af07fe026bcbbc6d5513ae1b4220
MD5 9087f714ed812d8000b052089eedea3d
SHA1 39becd2fed6e8df4ecaf64d63bd7f8baca003c49
SHA512 0923f75bc842ab76b42e395601c4825aedff6e73044f52ba733b759e846ceab16b92959e08cb14f5e9aad897c8c3509fbed744f6e872bd95e190dec0d34beea4
SSDEEP 384:UM92LPLe5lX4s1kXqKf/pUZNCgVLH2Hf989rUKhHG0gvj7dn:Uw2LPLIh4s1kXqKf/pUZNCgVLH2HfS9g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 252KB
SHA256 4d72b03dc3d3d0c49ce4f28ca62d5eeef3fca99435fb5c7b35e5f8e9891fe2d6
MD5 33c94822a7e2af4fc86cc79884066944
SHA1 e1f4e206e5ac487ee9c5d62ca7dc434a7a70acf2
SHA512 f0ce0f4a5e4bc5ecf5ccf9154e13555ed54e5cde86adbe184ef8a6dff920535e1f1b10464ab8f05db3c2cdcad71c8180451fbca14c51693f6160d7b15d97b83d
SSDEEP 6144:bTYLW30xFT+LOH5HIkNe+Y78RbxBVtEPY4aI1OB:6W3GRI0NY78fBfpAOB
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorha.exe

Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Size 3.1MB
SHA256 3c47706d4f9134f15703364aa00983381bc54b10553a2544fc11c190f7853eee
MD5 aafe7a7ca7b099b63dbf4519acb0a3ae
SHA1 1444e1cf228680b5876cc250b6cabbb59b2776c5
SHA512 be0d41d45501fa9460c73da7ed5ab0eeaf708e34def9a6b676ea6955b9c3f543201629bb9b3f6defdacdf25a77d16ee7a54b7776a17ecb742e841c27fa1c929e
SSDEEP 49152:FFaDRoV0y9zRtDdfSuMFqRDojzh372CqPUHppc8DxwQ9:SDj2zRtDdauMwREzh372CFppXDxwQ9
MD5 SHA1 SHA512 SSDEEP

Submit Download

052e0f34d9.exe

Path C:\Users\Admin\AppData\Local\Temp\1000055001\052e0f34d9.exe
Size 1.1MB
SHA256 e39b02c371b2ea2a466e367d330ae3a43bbc5769d3269a6a55b97cbdf0b56922
MD5 100238a1dbb028735cdb1ecd96c56086
SHA1 a464c5d2b5651840fb0519631f601f0d1a7a9fbe
SHA512 c57e8a9929666ef0ef63ec6098b1a552b8a40b9438c4b1fc00557fc909af1b365d2ab3b25bc6fe9a5e7ef9bd56cbc52b4068cc1d9697306facf8ca89b7c73b85
SSDEEP 24576:5qDEvCTbMWu7rQYlBQcBiT6rprG8auA2+b+HdiJUX:5TvC/MTQYxsWR7auA2+b+HoJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

5cb1d85663.exe

Path C:\Users\Admin\AppData\Local\Temp\1000056001\5cb1d85663.exe
Size 2.3MB
SHA256 7a16753d1def3ad4167b8252dede063b251550fde049cae6a62b622c493cde85
MD5 0c6ac532b5b112cd436c24e90830e58c
SHA1 cca39b294c05fde512c54e8bd9d3641f9dc76176
SHA512 eda0d2c2d0ce219d1ec47a48f8fbd98615ed136bf4f602637b8f01ae7ea39a65201dd3f746f55b6ba18d053ca9be3205ce8f7bb7822394e3c0d6204260e4a75e
SSDEEP 49152:IeF1xn14/M4o1oBhxjF+jLrMVpwF57y0VZIHF5WQvRZcvwBU:51xn1fx+vjF+jLrttpEF8QJo4U
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_0v22jmag.syl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0v22jmag.syl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Size 109KB
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
SSDEEP 3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 1.2MB
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
SSDEEP 24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/416-7-0x0000000005580000-0x0000000005581000-memory.dmp

Download

memory/416-0-0x0000000000C30000-0x0000000000F47000-memory.dmp

Download

memory/416-3-0x00000000055B0000-0x00000000055B1000-memory.dmp

Download

memory/416-5-0x00000000055A0000-0x00000000055A1000-memory.dmp

Download

memory/416-4-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download

memory/416-2-0x0000000000C30000-0x0000000000F47000-memory.dmp

Download

memory/416-22-0x0000000000C30000-0x0000000000F47000-memory.dmp

Download

memory/416-6-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/416-1-0x0000000077786000-0x0000000077788000-memory.dmp

Download

memory/416-10-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/416-9-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/416-8-0x0000000005590000-0x0000000005591000-memory.dmp

Download

memory/956-239-0x00000000054D0000-0x00000000054D1000-memory.dmp

Download

memory/956-242-0x0000000005550000-0x0000000005551000-memory.dmp

Download

memory/956-237-0x00000000054E0000-0x00000000054E1000-memory.dmp

Download

memory/956-236-0x0000000005510000-0x0000000005511000-memory.dmp

Download

memory/956-238-0x0000000005540000-0x0000000005541000-memory.dmp

Download

memory/956-241-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/956-240-0x00000000054C0000-0x00000000054C1000-memory.dmp

Download

memory/956-243-0x0000000005570000-0x0000000005571000-memory.dmp

Download

memory/956-235-0x0000000000840000-0x0000000000DEF000-memory.dmp

Download

memory/956-244-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/956-285-0x0000000000840000-0x0000000000DEF000-memory.dmp

Download

memory/956-281-0x0000000000840000-0x0000000000DEF000-memory.dmp

Download

memory/956-279-0x0000000000840000-0x0000000000DEF000-memory.dmp

Download

memory/956-275-0x0000000000840000-0x0000000000DEF000-memory.dmp

Download

memory/956-274-0x0000000000840000-0x0000000000DEF000-memory.dmp

Download

memory/956-245-0x0000000005560000-0x0000000005561000-memory.dmp

Download

memory/956-263-0x0000000000840000-0x0000000000DEF000-memory.dmp

Download

memory/956-247-0x00000000055A0000-0x00000000055A2000-memory.dmp

Download

memory/956-246-0x00000000054B0000-0x00000000054B1000-memory.dmp

Download

memory/960-56-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/960-49-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/960-70-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/960-48-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/960-55-0x00000000054E0000-0x00000000054E1000-memory.dmp

Download

memory/960-53-0x0000000005530000-0x0000000005531000-memory.dmp

Download

memory/960-54-0x00000000054D0000-0x00000000054D1000-memory.dmp

Download

memory/960-52-0x00000000054F0000-0x00000000054F1000-memory.dmp

Download

memory/960-50-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/960-51-0x0000000005510000-0x0000000005511000-memory.dmp

Download

memory/2220-34-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-35-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-193-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-203-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-204-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-282-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-280-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-276-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-27-0x0000000004C00000-0x0000000004C01000-memory.dmp

Download

memory/2220-273-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-23-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-262-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-24-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-33-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-216-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-26-0x0000000004C20000-0x0000000004C21000-memory.dmp

Download

memory/2220-187-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-28-0x0000000004C40000-0x0000000004C41000-memory.dmp

Download

memory/2220-177-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/2220-25-0x0000000004C10000-0x0000000004C11000-memory.dmp

Download

memory/2220-29-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Download

memory/2220-30-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Download

memory/2220-31-0x0000000004C60000-0x0000000004C61000-memory.dmp

Download

memory/2220-32-0x0000000004C50000-0x0000000004C51000-memory.dmp

Download

memory/2220-121-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/3252-69-0x00000221F9E50000-0x00000221F9E60000-memory.dmp

Download

memory/3252-68-0x00000221F9E50000-0x00000221F9E60000-memory.dmp

Download

memory/3252-78-0x00007FFE11030000-0x00007FFE11AF2000-memory.dmp

Download

memory/3252-72-0x00000221F9BC0000-0x00000221F9BCA000-memory.dmp

Download

memory/3252-65-0x00000221F9B50000-0x00000221F9B72000-memory.dmp

Download

memory/3252-66-0x00007FFE11030000-0x00007FFE11AF2000-memory.dmp

Download

memory/3252-71-0x00000221F9E30000-0x00000221F9E42000-memory.dmp

Download

memory/3252-67-0x00000221F9E50000-0x00000221F9E60000-memory.dmp

Download

memory/4256-208-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Download

memory/4256-210-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download

memory/4256-209-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Download

memory/4256-214-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/4256-212-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Download

memory/4256-207-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/4256-211-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download

memory/4256-206-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/4256-213-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download

memory/4996-284-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/4996-287-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Download

memory/4996-286-0x00000000005F0000-0x0000000000907000-memory.dmp

Download

memory/4996-293-0x00000000005F0000-0x0000000000907000-memory.dmp

Download