Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-05-2024 06:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    18c7b8a5b8cf9971b149a83dbde7724742a57b356d0a9d40734d664517ee44a8.exe

  • Size

    1.7MB

  • MD5

    79a9d6b3a0c7c928b7f6a721c0bae598

  • SHA1

    e1d197b088870e84b6fee0b5466de661e92a487c

  • SHA256

    18c7b8a5b8cf9971b149a83dbde7724742a57b356d0a9d40734d664517ee44a8

  • SHA512

    9a09087037fd270507206474439b73ac67b2763fa743cbd9fb9a3650b68c95ed78f4fb3c125c2a5e24f3aa67ff0b99cc5f4a3e511e5ac0a81300f617c3b2f6e6

  • SSDEEP

    24576:nn3cr3IlfISvHGEdlgskdujnlC/Hhge+SYL+5LPQhnmkJ/uP6a3vsE3Sio/doLN:n3zhTHmvdupCfqDSR/6uPV3UE3S4LN

Score
10/10
amadeylummaredlineriseprostealcxmrig118befc@cloudytteamc767c0zzvvdiscoveryevasionexecutioninfostealerminerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

stealc

Botnet

zzvv

C2

http://23.88.106.134

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://headraisepresidensu.shop/api

https://sofaprivateawarderysj.shop/api

https://lineagelasserytailsd.shop/api

https://tendencyportionjsuk.shop/api

https://appetitesallooonsj.shop/api

https://minorittyeffeoos.shop/api

https://prideconstituiiosjk.shop/api

https://smallelementyjdui.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • XMRig Miner payload 4 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 43 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\18c7b8a5b8cf9971b149a83dbde7724742a57b356d0a9d40734d664517ee44a8.exe
    "C:\Users\Admin\AppData\Local\Temp\18c7b8a5b8cf9971b149a83dbde7724742a57b356d0a9d40734d664517ee44a8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:3484
        • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:460
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:656
            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1800
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4212
                • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                  7⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1580
                • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2504
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                  7⤵
                    PID:1468
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      8⤵
                        PID:1996
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 332
                    6⤵
                    • Program crash
                    PID:456
                • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2000
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:4048
                  • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3740
                  • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                    5⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of WriteProcessMemory
                    PID:876
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameStabilityService\installm.bat" "
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1768
                      • C:\Windows\SysWOW64\sc.exe
                        Sc delete GameSyncLinks
                        7⤵
                        • Launches sc.exe
                        PID:892
                      • C:\Program Files (x86)\GameStabilityService\GameService.exe
                        GameService remove GameSyncLinks confirm
                        7⤵
                        • Executes dropped EXE
                        PID:4368
                      • C:\Program Files (x86)\GameStabilityService\GameService.exe
                        GameService install GameStabilityService "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:404
                      • C:\Program Files (x86)\GameStabilityService\GameService.exe
                        GameService start GameStabilityService
                        7⤵
                        • Executes dropped EXE
                        PID:3292
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                      6⤵
                        PID:4496
                    • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:3124
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                          PID:1584
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          6⤵
                            PID:1764
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            6⤵
                              PID:3656
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              6⤵
                              • Loads dropped DLL
                              • Checks processor information in registry
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3148
                          • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:4940
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              6⤵
                                PID:2000
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                6⤵
                                  PID:2824
                              • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                                5⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                PID:3944
                                • C:\Windows\SysWOW64\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                                  6⤵
                                  • Creates scheduled task(s)
                                  PID:1616
                              • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                                5⤵
                                • UAC bypass
                                • Windows security bypass
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Windows security modification
                                • Checks whether UAC is enabled
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                • System policy modification
                                PID:1640
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe" -Force
                                  6⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4916
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
                                  6⤵
                                    PID:4872
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
                                    6⤵
                                      PID:3884
                              • C:\Users\Admin\AppData\Local\Temp\1000014001\3fe6708cfb.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000014001\3fe6708cfb.exe"
                                3⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                PID:3556
                          • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                            C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            PID:1232
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1800 -ip 1800
                            1⤵
                              PID:3016
                            • C:\Program Files (x86)\GameStabilityService\GameService.exe
                              "C:\Program Files (x86)\GameStabilityService\GameService.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:4900
                              • C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
                                "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
                                2⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                PID:1552
                                • C:\Windows\Temp\176614.exe
                                  "C:\Windows\Temp\176614.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 86Adxfq6AnkKUZNQwBuLMF9HYKxy399q4GoNvX86ddj4DNkHhKaPCWagERDeBPVYSw76hQwZATyV8GAWhX5g2ujETX6AWcp --coin XMR -t 1 --no-color -p x
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  PID:4864
                                • C:\Windows\Temp\514412.exe
                                  "C:\Windows\Temp\514412.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 86Adxfq6AnkKUZNQwBuLMF9HYKxy399q4GoNvX86ddj4DNkHhKaPCWagERDeBPVYSw76hQwZATyV8GAWhX5g2ujETX6AWcp --coin XMR -t 1 --no-color -p x
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  PID:1860
                            • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                              C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2892
                            • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:1808
                            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                              C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                              1⤵
                              • Executes dropped EXE
                              PID:3904
                            • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                              C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2144
                            • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:1500
                            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                              C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                              1⤵
                              • Executes dropped EXE
                              PID:1656

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            1
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Scheduled Task/Job

                            1
                            T1053

                            System Services

                            1
                            T1569

                            Service Execution

                            1
                            T1569.002

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Scheduled Task/Job

                            1
                            T1053

                            Privilege Escalation

                            Abuse Elevation Control Mechanism

                            1
                            T1548

                            Bypass User Account Control

                            1
                            T1548.002

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Scheduled Task/Job

                            1
                            T1053

                            Defense Evasion

                            Abuse Elevation Control Mechanism

                            1
                            T1548

                            Bypass User Account Control

                            1
                            T1548.002

                            Impair Defenses

                            4
                            T1562

                            Disable or Modify Tools

                            3
                            T1562.001

                            Modify Registry

                            6
                            T1112

                            Subvert Trust Controls

                            1
                            T1553

                            Install Root Certificate

                            1
                            T1553.004

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Credential Access

                            Unsecured Credentials

                            3
                            T1552

                            Credentials In Files

                            3
                            T1552.001

                            Discovery

                            Query Registry

                            6
                            T1012

                            System Information Discovery

                            5
                            T1082

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Lateral Movement

                            Collection

                            Data from Local System

                            3
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Service Stop

                            1
                            T1489

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Program Files (x86)\GameStabilityService\GameService.exe
                              Filesize

                              288KB

                              MD5

                              d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                              SHA1

                              e1908caab6f938404af85a7df0f80f877a4d9ee6

                              SHA256

                              472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                              SHA512

                              1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                              Download Submit
                            • C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
                              Filesize

                              6.2MB

                              MD5

                              c4f2b643c3ff9bb7ae4fd625c9d98154

                              SHA1

                              bd7c7190e45cbda09be256bee7622bb74f75f00c

                              SHA256

                              76b585b4eac7b0584f28d66d6bf37ad29b1ab73354cbd3c5bb1c819787208f0b

                              SHA512

                              2efeaf9473ac1a8f42fd5870154faa37b06e4f331768cd7934fd4aa685eb6da4e28eaa7357807c4bf37dd79fc4a5eaf70ab4324ed0100dcdb4abaf4d9b0a7dcb

                              Download Submit
                            • C:\Program Files (x86)\GameStabilityService\installm.bat
                              Filesize

                              247B

                              MD5

                              192ae14b572f1bdd164ee67855d5a83a

                              SHA1

                              9cf0757c807a8b834470d216ccd85be9a6b60aa0

                              SHA256

                              2f6be6b40cf7c1802b6540dbf0b90eac67fd6a94067a06090e1f71bee164188d

                              SHA512

                              18fc80eb3d450359863d61cf9123a08cdfe8c52d5f59e97f5b42816584d474d8a080bb75e7fe92480d2961481d59584a3987b2e7a15e611b58885b4441085e3c

                              Download Submit
                            • C:\ProgramData\mozglue.dll
                              Filesize

                              593KB

                              MD5

                              c8fd9be83bc728cc04beffafc2907fe9

                              SHA1

                              95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                              SHA256

                              ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                              SHA512

                              fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                              Download Submit
                            • C:\ProgramData\nss3.dll
                              Filesize

                              2.0MB

                              MD5

                              1cc453cdf74f31e4d913ff9c10acdde2

                              SHA1

                              6e85eae544d6e965f15fa5c39700fa7202f3aafe

                              SHA256

                              ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                              SHA512

                              dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                              Filesize

                              2.7MB

                              MD5

                              31841361be1f3dc6c2ce7756b490bf0f

                              SHA1

                              ff2506641a401ac999f5870769f50b7326f7e4eb

                              SHA256

                              222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                              SHA512

                              53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                              Filesize

                              474KB

                              MD5

                              e967f019b01357086d92181e6ee28e0b

                              SHA1

                              7f26480ea5ca0ee9481dfc0bea12194bd6f10283

                              SHA256

                              c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

                              SHA512

                              dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                              Filesize

                              304KB

                              MD5

                              9faf597de46ed64912a01491fe550d33

                              SHA1

                              49203277926355afd49393782ae4e01802ad48af

                              SHA256

                              0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                              SHA512

                              ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                              Filesize

                              2.0MB

                              MD5

                              1d814be25e80fa6739f6f1eec2018102

                              SHA1

                              44353b52a72e3f5c46b3d6078aab1211ce33b4fd

                              SHA256

                              01862602fb4853d90796a1a669b4ec4ab5e8cc6a774bf94e707171d5e16594fc

                              SHA512

                              15732577c4fd4a0d2303df2f2d623e165c94f5b8dcd92724681d41ac35ecefbe8c04052329ec6938a594086bf8a19a54253be9f33cc8b3a298261467cddf5578

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                              Filesize

                              778KB

                              MD5

                              05b11e7b711b4aaa512029ffcb529b5a

                              SHA1

                              a8074cf8a13f21617632951e008cdfdace73bb83

                              SHA256

                              2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                              SHA512

                              dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                              Filesize

                              1.2MB

                              MD5

                              56e7d98642cfc9ec438b59022c2d58d7

                              SHA1

                              26526f702e584d8c8b629b2db5d282c2125665d7

                              SHA256

                              a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                              SHA512

                              0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
                              Filesize

                              1.8MB

                              MD5

                              9790031049fe79a6066b00a4b2a7b70c

                              SHA1

                              29ed66776d7d33ce155bc2b7c684e9dd2ec3d8eb

                              SHA256

                              173d3a18795ba72439a91713dec3aaea72b5c23bb979e94f6696111943a2af78

                              SHA512

                              d279185383bd93dc1a5cafdcf7a34b24f08496859f230abcae49abea608c921bf00e16081df68103f00570a6789f7b3d0e674eb9e3cfc09cf709d5782287c71c

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000014001\3fe6708cfb.exe
                              Filesize

                              2.2MB

                              MD5

                              4d44cd951806e090363ce3aa480d3ab3

                              SHA1

                              c8e5c5e56bfecf2790c71c46cd8fb45f2537cb2b

                              SHA256

                              074416192a7049def5f7258553fde8296d8743c2451dc26c3101b43c8ee68aa4

                              SHA512

                              3b26c52941b00374a2b99f9637b5fe86e4c20d0316e80f504d7602bdfbbb6e86c071e53daf46c63da7bca35b31f67f6592f7113af70b5ac9b0a3020bb87ff87b

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                              Filesize

                              418KB

                              MD5

                              0099a99f5ffb3c3ae78af0084136fab3

                              SHA1

                              0205a065728a9ec1133e8a372b1e3864df776e8c

                              SHA256

                              919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                              SHA512

                              5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                              Filesize

                              379KB

                              MD5

                              009669d63111ff8efad651efac7333af

                              SHA1

                              d0ebf3a228e2d44e094aa3b1b056176bc05c8f40

                              SHA256

                              4736228698b5bb9b7dc86f4dbfe539e54fe5f5153be6c4aec7b8269e34c7a84b

                              SHA512

                              dbf32ce7ba68fa88f508bced74b898baa73679216374d885e279eaf848c8f197294f66a0131491050f70f93413d973cc1fe7245e8128758a6103a453e7aed808

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                              Filesize

                              208B

                              MD5

                              2dbc71afdfa819995cded3cc0b9e2e2e

                              SHA1

                              60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

                              SHA256

                              5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

                              SHA512

                              0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              Filesize

                              1.7MB

                              MD5

                              79a9d6b3a0c7c928b7f6a721c0bae598

                              SHA1

                              e1d197b088870e84b6fee0b5466de661e92a487c

                              SHA256

                              18c7b8a5b8cf9971b149a83dbde7724742a57b356d0a9d40734d664517ee44a8

                              SHA512

                              9a09087037fd270507206474439b73ac67b2763fa743cbd9fb9a3650b68c95ed78f4fb3c125c2a5e24f3aa67ff0b99cc5f4a3e511e5ac0a81300f617c3b2f6e6

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\Tmp8DE8.tmp
                              Filesize

                              2KB

                              MD5

                              1420d30f964eac2c85b2ccfe968eebce

                              SHA1

                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                              SHA256

                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                              SHA512

                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                              Download Submit
                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3pzflt1u.hie.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit
                            • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2804150937-2146708401-419095071-1000\76b53b3ec448f7ccdda2063b15d2bfc3_5a32ead2-14a8-4b34-b6a3-85cfb28e2fbd
                              Filesize

                              2KB

                              MD5

                              dd4026ec1513e86925783a3261c02a29

                              SHA1

                              9ecc016f4d2327f141cd554e44836869f03054f5

                              SHA256

                              d526a1701b60375a92b4d7d9b6a8ede0044f45a22863c0220a32d9d1ffe621f4

                              SHA512

                              756b79599e53da55e871b6fc5f22d01618567eade2fe86d65af0b6aa7a765466bffe02f74b428e5c3933de9caba1d9521bc16638993e105d2fd3cf1d0913f453

                              Download Submit
                            • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                              Filesize

                              304KB

                              MD5

                              0c582da789c91878ab2f1b12d7461496

                              SHA1

                              238bd2408f484dd13113889792d6e46d6b41c5ba

                              SHA256

                              a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                              SHA512

                              a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                              Download Submit
                            • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                              Filesize

                              750KB

                              MD5

                              20ae0bb07ba77cb3748aa63b6eb51afb

                              SHA1

                              87c468dc8f3d90a63833d36e4c900fa88d505c6d

                              SHA256

                              daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                              SHA512

                              db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                              Download Submit
                            • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                              Filesize

                              2KB

                              MD5

                              718048dcb9d505f5cc3b633b8e74902d

                              SHA1

                              696bad822551d7fb4ecdda1ba6cd29f6697a0032

                              SHA256

                              43ae9fbf7418b1b79db6b9121faf48d9d213fc4eab3b09b660a99905cc42a65d

                              SHA512

                              ca519b4c02e9861a9098b7e093db69de4e02374a889a3a1a513bdbac94fbdd7ee9c7bb36e420bbed6ca1d9249edb3f929e323d6eee409e36bef63ad29135cca8

                              Download Submit
                            • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                              Filesize

                              2KB

                              MD5

                              57802067b24d05300cdd369ee6a48c48

                              SHA1

                              3fd216573d9d1329598cfeeeeb8c38accfdfdd4e

                              SHA256

                              adfd8cdab6e6ac5a5b5b234e05be88ec741a5b20627c97e442f34fb206b54d2b

                              SHA512

                              c631ad8e69412499cc4d7ef9359f9c0c8525f7b1eca26d139b52c1e04924099049b1cdf406e6518389eb5fc7792977a11ef4c010205d05b811eb51a739a97ecc

                              Download Submit
                            • C:\Users\Public\Desktop\Google Chrome.lnk
                              Filesize

                              2KB

                              MD5

                              2128be6b7c279ef791f6dff3bf23ea34

                              SHA1

                              b452eac07cd95b9088ba9eb82e403dbe426af6b3

                              SHA256

                              fd83769ffaaff3d66b89e82a20a7574ba5073b84bcf88ab090ae5443b35f5f8e

                              SHA512

                              1f07e72bacd3836809d282da397ed2ca9aa634e0b4fc8b947de7aae1a511f9f80e8f7a1b0bacdcb5cd62fb430b3b9e534330877e238c95302884fd71497cc046

                              Download Submit
                            • C:\Users\Public\Desktop\Google Chrome.lnk
                              Filesize

                              2KB

                              MD5

                              8e56749da6a3af20eb210a35003f4622

                              SHA1

                              4b58c1888e6e1c05b32e3eea8a691edafb9b3114

                              SHA256

                              249a61c02618ccc34a6dfe56a8a90916f9ed2ecf87be1ec7ed6e325844fa7d57

                              SHA512

                              4ecac9a46eec06b991e1cf652a70de575ec9ed9b012f784710a4655bac212d6ae30755ea877e6a38b25af4bcb4162719f03917d38f62c582b462db8f641bdf05

                              Download Submit
                            • C:\Windows\Temp\176614.exe
                              Filesize

                              6.0MB

                              MD5

                              5cdb390aaba8caad929f5891f86cf8d7

                              SHA1

                              324a43fa56dffe541c0414f253faf2bf34ad9fa4

                              SHA256

                              1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44

                              SHA512

                              9e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9

                              Download Submit
                            • memory/212-3-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/212-4-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/212-6-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/212-5-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/212-7-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/212-23-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/212-2-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/212-0-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/212-1-0x0000000000310000-0x000000000085E000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/460-57-0x0000000000BA0000-0x0000000001058000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/460-70-0x0000000000BA0000-0x0000000001058000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/656-478-0x0000000000F10000-0x00000000013C8000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/656-252-0x0000000000F10000-0x00000000013C8000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/656-451-0x0000000000F10000-0x00000000013C8000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/656-71-0x0000000000F10000-0x00000000013C8000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/1232-37-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1232-35-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1232-36-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1232-33-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1232-30-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1232-31-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1232-34-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1232-32-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1232-41-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1500-528-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1500-537-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1580-182-0x0000000007240000-0x0000000007858000-memory.dmp
                              Filesize

                              6.1MB

                              Download
                            • memory/1580-150-0x0000000005A20000-0x0000000005FC4000-memory.dmp
                              Filesize

                              5.6MB

                              Download
                            • memory/1580-313-0x0000000006FE0000-0x0000000007046000-memory.dmp
                              Filesize

                              408KB

                              Download
                            • memory/1580-445-0x0000000008530000-0x0000000008A5C000-memory.dmp
                              Filesize

                              5.2MB

                              Download
                            • memory/1580-444-0x0000000007E30000-0x0000000007FF2000-memory.dmp
                              Filesize

                              1.8MB

                              Download
                            • memory/1580-179-0x0000000006AC0000-0x0000000006ADE000-memory.dmp
                              Filesize

                              120KB

                              Download
                            • memory/1580-174-0x00000000061D0000-0x0000000006246000-memory.dmp
                              Filesize

                              472KB

                              Download
                            • memory/1580-184-0x0000000006CD0000-0x0000000006CE2000-memory.dmp
                              Filesize

                              72KB

                              Download
                            • memory/1580-183-0x0000000006D90000-0x0000000006E9A000-memory.dmp
                              Filesize

                              1.0MB

                              Download
                            • memory/1580-185-0x0000000006D30000-0x0000000006D6C000-memory.dmp
                              Filesize

                              240KB

                              Download
                            • memory/1580-194-0x0000000006EA0000-0x0000000006EEC000-memory.dmp
                              Filesize

                              304KB

                              Download
                            • memory/1580-156-0x0000000005730000-0x000000000573A000-memory.dmp
                              Filesize

                              40KB

                              Download
                            • memory/1580-145-0x0000000000C60000-0x0000000000CB2000-memory.dmp
                              Filesize

                              328KB

                              Download
                            • memory/1580-151-0x0000000005570000-0x0000000005602000-memory.dmp
                              Filesize

                              584KB

                              Download
                            • memory/1640-453-0x000001B9D5CB0000-0x000001B9D5D0C000-memory.dmp
                              Filesize

                              368KB

                              Download
                            • memory/1640-426-0x000001B9BB6F0000-0x000001B9BB6FA000-memory.dmp
                              Filesize

                              40KB

                              Download
                            • memory/1808-500-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1808-488-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-99-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-21-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-22-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-28-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-25-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-24-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-26-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-19-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/1924-27-0x0000000000590000-0x0000000000ADE000-memory.dmp
                              Filesize

                              5.3MB

                              Download
                            • memory/2000-177-0x0000000000F10000-0x0000000000F11000-memory.dmp
                              Filesize

                              4KB

                              Download
                            • memory/2000-175-0x0000000000F10000-0x0000000000F11000-memory.dmp
                              Filesize

                              4KB

                              Download
                            • memory/2144-523-0x0000000000F10000-0x00000000013C8000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/2144-535-0x0000000000F10000-0x00000000013C8000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/2504-258-0x000000001BF80000-0x000000001BFBC000-memory.dmp
                              Filesize

                              240KB

                              Download
                            • memory/2504-285-0x000000001ED70000-0x000000001EF32000-memory.dmp
                              Filesize

                              1.8MB

                              Download
                            • memory/2504-286-0x000000001F470000-0x000000001F998000-memory.dmp
                              Filesize

                              5.2MB

                              Download
                            • memory/2504-272-0x000000001BF60000-0x000000001BF7E000-memory.dmp
                              Filesize

                              120KB

                              Download
                            • memory/2504-271-0x000000001E380000-0x000000001E3F6000-memory.dmp
                              Filesize

                              472KB

                              Download
                            • memory/2504-256-0x000000001E490000-0x000000001E59A000-memory.dmp
                              Filesize

                              1.0MB

                              Download
                            • memory/2504-257-0x000000001BF20000-0x000000001BF32000-memory.dmp
                              Filesize

                              72KB

                              Download
                            • memory/2504-155-0x0000000000650000-0x0000000000710000-memory.dmp
                              Filesize

                              768KB

                              Download
                            • memory/2824-401-0x0000000000400000-0x0000000000458000-memory.dmp
                              Filesize

                              352KB

                              Download
                            • memory/2824-399-0x0000000000400000-0x0000000000458000-memory.dmp
                              Filesize

                              352KB

                              Download
                            • memory/2892-486-0x0000000000F10000-0x00000000013C8000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/2892-497-0x0000000000F10000-0x00000000013C8000-memory.dmp
                              Filesize

                              4.7MB

                              Download
                            • memory/3124-282-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
                              Filesize

                              4KB

                              Download
                            • memory/3148-297-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                              Filesize

                              972KB

                              Download
                            • memory/3148-281-0x0000000000400000-0x000000000063B000-memory.dmp
                              Filesize

                              2.2MB

                              Download
                            • memory/3148-283-0x0000000000400000-0x000000000063B000-memory.dmp
                              Filesize

                              2.2MB

                              Download
                            • memory/3556-98-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-253-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-94-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-93-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-92-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-91-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-95-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-97-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-90-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3556-96-0x0000000000260000-0x00000000008F2000-memory.dmp
                              Filesize

                              6.6MB

                              Download
                            • memory/3740-449-0x00000000071C0000-0x0000000007210000-memory.dmp
                              Filesize

                              320KB

                              Download
                            • memory/3740-205-0x0000000000270000-0x00000000002C2000-memory.dmp
                              Filesize

                              328KB

                              Download
                            • memory/4048-176-0x0000000000400000-0x0000000000457000-memory.dmp
                              Filesize

                              348KB

                              Download
                            • memory/4048-178-0x0000000000400000-0x0000000000457000-memory.dmp
                              Filesize

                              348KB

                              Download
                            • memory/4212-115-0x0000000000400000-0x0000000000592000-memory.dmp
                              Filesize

                              1.6MB

                              Download
                            • memory/4864-394-0x000001899C1D0000-0x000001899C1F0000-memory.dmp
                              Filesize

                              128KB

                              Download
                            • memory/4916-456-0x0000020CEF260000-0x0000020CEF282000-memory.dmp
                              Filesize

                              136KB

                              Download
                            • memory/4940-400-0x0000000000840000-0x0000000000841000-memory.dmp
                              Filesize

                              4KB

                              Download