amadey | 71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
18-06-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
Size

1.8MB
MD5

5cb24c125b68ab8b49a491c9212a64d1
SHA1

37964f6b2845df59872d3e045000ded774b2f9f6
SHA256

71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd
SHA512

a92143f1ee7781e5db87bbe63cc5e97c4fe52c9afda1338d5a20be7eceaf26c7caac85098b76ad49fa1cd61eaa6a3e5e0340cbcd6f6714cbf7801b0453f10d04
SSDEEP

49152:aeLeF+eP+SOrftAQFV64768BI6V2inyYZuSNKAztAc08:r8+SOrlhc476YI6V/zKEtP0

Score

10^/10

amadey risepro 0e6740 e76b71 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

http://77.91.77.81

Attributes

install_dir
8254624243
install_file
axplong.exe
strings_key
90049e51fabf09df0d6748e0b271922e
url_paths
/Kiru9gu/index.php

rc4.plain

Extracted

Family

risepro

147.45.47.126:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5d02212865.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5d02212865.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5d02212865.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe

Executes dropped EXE 11 IoCs

pid	Process
2128	explortu.exe
2632	5d02212865.exe
4540	301d04cc67.exe
688	axplong.exe
2552	9b05abb809.exe
2896	axplong.exe
1072	explortu.exe
1908	axplong.exe
3368	explortu.exe
2248	axplong.exe
3816	explortu.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	5d02212865.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
Key opened	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Wine	explortu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2394516847-3409208829-2230326962-1000\Software\Microsoft\Windows\CurrentVersion\Run\301d04cc67.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\301d04cc67.exe"	explortu.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa8e-75.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs

pid	Process
844	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
2128	explortu.exe
2632	5d02212865.exe
688	axplong.exe
4540	301d04cc67.exe
2896	axplong.exe
1072	explortu.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
3368	explortu.exe
1908	axplong.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
4540	301d04cc67.exe
2248	axplong.exe
3816	explortu.exe
4540	301d04cc67.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	5d02212865.exe
File created	C:\Windows\Tasks\explortu.job	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133631971781884026"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2394516847-3409208829-2230326962-1000\{E0522477-BCBA-42BE-A3F3-ED4018C15BAE}	chrome.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
844	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
844	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
2128	explortu.exe
2128	explortu.exe
2632	5d02212865.exe
2632	5d02212865.exe
688	axplong.exe
688	axplong.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
2896	axplong.exe
2896	axplong.exe
1072	explortu.exe
1072	explortu.exe
3368	explortu.exe
3368	explortu.exe
1908	axplong.exe
1908	axplong.exe
1864	chrome.exe
1864	chrome.exe
2248	axplong.exe
2248	axplong.exe
3816	explortu.exe
3816	explortu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe
Token: SeShutdownPrivilege	5016	chrome.exe
Token: SeCreatePagefilePrivilege	5016	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2552	9b05abb809.exe
2552	9b05abb809.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
2552	9b05abb809.exe
5016	chrome.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
5016	chrome.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2552	9b05abb809.exe
2552	9b05abb809.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
5016	chrome.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe
2552	9b05abb809.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4540	301d04cc67.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 844 wrote to memory of 2128	844	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe	81
PID 844 wrote to memory of 2128	844	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe	81
PID 844 wrote to memory of 2128	844	71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe	81
PID 2128 wrote to memory of 1152	2128	explortu.exe	82
PID 2128 wrote to memory of 1152	2128	explortu.exe	82
PID 2128 wrote to memory of 1152	2128	explortu.exe	82
PID 2128 wrote to memory of 2632	2128	explortu.exe	83
PID 2128 wrote to memory of 2632	2128	explortu.exe	83
PID 2128 wrote to memory of 2632	2128	explortu.exe	83
PID 2128 wrote to memory of 4540	2128	explortu.exe	84
PID 2128 wrote to memory of 4540	2128	explortu.exe	84
PID 2128 wrote to memory of 4540	2128	explortu.exe	84
PID 2632 wrote to memory of 688	2632	5d02212865.exe	85
PID 2632 wrote to memory of 688	2632	5d02212865.exe	85
PID 2632 wrote to memory of 688	2632	5d02212865.exe	85
PID 2128 wrote to memory of 2552	2128	explortu.exe	86
PID 2128 wrote to memory of 2552	2128	explortu.exe	86
PID 2128 wrote to memory of 2552	2128	explortu.exe	86
PID 2552 wrote to memory of 5016	2552	9b05abb809.exe	87
PID 2552 wrote to memory of 5016	2552	9b05abb809.exe	87
PID 5016 wrote to memory of 3976	5016	chrome.exe	90
PID 5016 wrote to memory of 3976	5016	chrome.exe	90
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 924	5016	chrome.exe	91
PID 5016 wrote to memory of 3764	5016	chrome.exe	92
PID 5016 wrote to memory of 3764	5016	chrome.exe	92
PID 5016 wrote to memory of 3144	5016	chrome.exe	93
PID 5016 wrote to memory of 3144	5016	chrome.exe	93
PID 5016 wrote to memory of 3144	5016	chrome.exe	93
PID 5016 wrote to memory of 3144	5016	chrome.exe	93
PID 5016 wrote to memory of 3144	5016	chrome.exe	93
PID 5016 wrote to memory of 3144	5016	chrome.exe	93
PID 5016 wrote to memory of 3144	5016	chrome.exe	93
PID 5016 wrote to memory of 3144	5016	chrome.exe	93
PID 5016 wrote to memory of 3144	5016	chrome.exe	93

C:\Users\Admin\AppData\Local\Temp\71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe
"C:\Users\Admin\AppData\Local\Temp\71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:844
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:1152
- - C:\Users\Admin\1000015002\5d02212865.exe
    "C:\Users\Admin\1000015002\5d02212865.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:688
- - C:\Users\Admin\AppData\Local\Temp\1000016001\301d04cc67.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\301d04cc67.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetWindowsHookEx
    PID:4540
- - C:\Users\Admin\AppData\Local\Temp\1000017001\9b05abb809.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\9b05abb809.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9c509ab58,0x7ff9c509ab68,0x7ff9c509ab78
        5⤵
        
        PID:3976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:2
        5⤵
        
        PID:924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:8
        5⤵
        
        PID:3764
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2148 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:8
        5⤵
        
        PID:3144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:1
        5⤵
        
        PID:4408
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:1
        5⤵
        
        PID:4480
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4252 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:1
        5⤵
        
        PID:4740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3364 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:1
        5⤵
        
        PID:4948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4476 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:8
        5⤵
        
        PID:5020
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:740
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:8
        5⤵
        
        PID:2776
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:8
        5⤵
        
        PID:4984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:8
        5⤵
        
        PID:3816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2392 --field-trial-handle=1844,i,15450837839487523956,8856967167045215166,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1864

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:2856

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2896

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1072

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1908

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3368

C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2248

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\1000015002\5d02212865.exe

Filesize
1.8MB

MD5
c937d55d6dcbd955a49067cf5fa0c957

SHA1
3ac9586178a2a371f16ffd619d406c5e48d95819

SHA256
18ca58235d9254530124dd49979f54c7f44f8a35ce322f769a88c75a63ffda3d

SHA512
c3681c6e51f2c2b5505a8c733550a269b60b8987aa7deb734cafceec9dc9bf4fba7294e459cf091355da32982ef9e6df12d22ae168a1e314e4041f50917cb064

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
023c95decd52a91cf079e86a628c09c4

SHA1
85fc12cd2d37eb02c94a0c64725397efe52efc87

SHA256
42842eb3169510f7d9bcbf027b15a85a1fb2129acbd515be20cc506d142d1277

SHA512
28db387f0c028b7530c9e52c6e4ab89fd2e5679c7580e1c0fb0133365f1035094f4cdca8021d6ba336043383bc784c24a6370ca8a1a18a1b5e91ce359a59feb9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a6dafa645a7abb0b38b491dd57ec61a2

SHA1
18ffaa0d37a3afead33616f2da16eb948eaf138a

SHA256
e5182777061f58a1b49f2a7fa8b4429d7044e68339363323fb4916dd5fbc86e5

SHA512
8f1058509cd9174e9645b5276441d48b3551debe32809310370dc7a826409a73f01038a4ab074665807e6ed4b124fdb3236e57ab60cff2d8bf322fea0983a4ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
378bef62a0cd9ca0d2f08ee30d3befee

SHA1
6d3152a87a84d2182502b0ce70e48891b2fa362c

SHA256
f8a622f981d98194f6e1cc870105bf8568e4be0d0bd14d1b12973eba2e55c37b

SHA512
8911f0dea7daeb45b1075d8304e61360faf2d5cdfd6755da2599bc6402d2c24b6d75ef959c148a2c1717de20658271263eb58719e34f125d7867ac7b20350749

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
522B

MD5
61af6bae6e11d3e136a2fdae079f38ec

SHA1
8241315327dc9cb347fa160c1c16f071a9d9373e

SHA256
65c7367047a29cce2ceb12f6c5eb4b38cc4c8a36948706efe10910f50c542280

SHA512
24752f28005ce9638ac34bc5b84098909c13d8d3a891a06c2a6b7ca7311e2b07ef9dae56d75f2f78fb6ec058dbe3e3a8d96e2d9823aca0915185772b5f6dcfde

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b0221802-bc2f-4f7e-b50a-f16e6bb7969e.tmp

Filesize
520B

MD5
7dc1ccddf019f80dafb93817a8936f42

SHA1
6cd664fc6ea1e0c87a65ec376ef296a7b3f959d9

SHA256
590bc1f3305711fbbb5b9ae5dda08d20a6e8538818a8f0c3145badcfec662d84

SHA512
9c7984c0f1cf64618026a244314854c7b4bf13ac9bad0b74a54ba599b137198878b29467ba901c9dee224a1a3f19d0376f79207f607e7baf2501aac9266a8d30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
37557405d75bb8ca61f0bbe9cc98dc9d

SHA1
8703f44eb6663f5735697934ab64ce392eca39a5

SHA256
76e19e3deebc1e1d6b587cc04749d81e2b4f4b359d7bac50475458612d48c189

SHA512
0ccb38451fdb01d14b4aca2daed13e6a172d9547ed77024397292915531a4a3bf7b7106bddcd40d40c136e53ceb6fa09d8662e8da9cf7c1747d7747cd77d1c5f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
9957866b09602e1c4113544e896a07f3

SHA1
7873115c38c99969ac373047d2c7ca85a8a7b5ea

SHA256
270968d8a79e6d7a374e1e6cf6e1450539e536f2e91500dd686efd1101e04889

SHA512
0c841c70ec6dcd91808ec7706fb2f1f0bcc3d07bfd44177338204376699193b7a2eb97501bfb6025c5f2fd4fad7b279887c6fd05bae1a32ee88e220527749724

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
277KB

MD5
aa9dda0e9e360176a9564bd332fdda4c

SHA1
4b17798cff77c188d2fffc9007f3caf8ff3ecb7d

SHA256
8a0d462a4c208f38e25dabf0c8b4b4692ac5898e7a2fe7479c3172e5922c3f5b

SHA512
7c5d6c6781082dcb2381d2e0977d17f435753967ffe05eced30ecc993169102802ab572152f530fb1dc6021e7cf6234c96bbfd6012a3ff1a8e97af17000de6a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\301d04cc67.exe

Filesize
1.3MB

MD5
8fca88e2fc0f89dead64a3bd3f333e82

SHA1
3a25daedcfd5660b6d1c0d77b53e13c3ecc00db2

SHA256
b7f4523d9fd9035171310e5231ac92c4ae1c9e29434aca5bdb75a507d895af03

SHA512
52fb83978a233a508f6fbf92f53df267feb4238119829c4e365fcb22bebc442276fa0e0ba1d854b2552872637db8f919da14ca2cb75bdc5a6cb561800837177f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\9b05abb809.exe

Filesize
1.1MB

MD5
e6906414433761a57240345dc4b4f7d0

SHA1
de9f00ba4684904f7659ff33ded621175aad6b56

SHA256
4f05f735593eff90dd074ce4b1007100966f4f347be0b7dd0faf192ce5862efa

SHA512
3f51ccd133516e918ccc39a4bcfb767e18c4ca601f4d2b34b26564963b7a32d305feca91373d404791d9dfa8329db3f95e36cc1a353d56727f6972c93a0b9fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe

Filesize
1.8MB

MD5
5cb24c125b68ab8b49a491c9212a64d1

SHA1
37964f6b2845df59872d3e045000ded774b2f9f6

SHA256
71d4c550ae082cdf4cd969c09855cf19c55e472c30f8b88a9f0c0cd2ebb96efd

SHA512
a92143f1ee7781e5db87bbe63cc5e97c4fe52c9afda1338d5a20be7eceaf26c7caac85098b76ad49fa1cd61eaa6a3e5e0340cbcd6f6714cbf7801b0453f10d04

Download Submit
memory/688-181-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-244-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-253-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-256-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-70-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-247-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-250-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-180-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-192-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-283-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-204-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-151-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-208-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-215-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-269-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/688-189-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/844-2-0x0000000000321000-0x000000000034F000-memory.dmp

Filesize
184KB

Download
memory/844-0-0x0000000000320000-0x00000000007B1000-memory.dmp

Filesize
4.6MB

Download
memory/844-3-0x0000000000320000-0x00000000007B1000-memory.dmp

Filesize
4.6MB

Download
memory/844-1-0x0000000077286000-0x0000000077288000-memory.dmp

Filesize
8KB

Download
memory/844-5-0x0000000000320000-0x00000000007B1000-memory.dmp

Filesize
4.6MB

Download
memory/844-17-0x0000000000320000-0x00000000007B1000-memory.dmp

Filesize
4.6MB

Download
memory/1072-149-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/1072-146-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/1908-212-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/1908-218-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/2128-190-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-143-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-18-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-187-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-202-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-281-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-19-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-205-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-251-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-135-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-209-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-168-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-263-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-245-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-20-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-254-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-152-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-248-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2128-233-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/2248-266-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/2248-270-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/2632-38-0x0000000000F10000-0x00000000013CE000-memory.dmp

Filesize
4.7MB

Download
memory/2632-69-0x0000000000F10000-0x00000000013CE000-memory.dmp

Filesize
4.7MB

Download
memory/2896-148-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/2896-144-0x00000000001F0000-0x00000000006AE000-memory.dmp

Filesize
4.7MB

Download
memory/3368-216-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/3368-214-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/3816-268-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/3816-271-0x0000000000070000-0x0000000000501000-memory.dmp

Filesize
4.6MB

Download
memory/4540-211-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-55-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-252-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-255-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-249-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-246-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-265-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-243-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-150-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-188-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-178-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-206-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-203-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-179-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-282-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download
memory/4540-191-0x00000000004F0000-0x0000000000A22000-memory.dmp

Filesize
5.2MB

Download