amadey | 281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd

Analysis

max time kernel
299s
max time network
297s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
24/06/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
Size 1.8MB
Sample240624-ft6eqa1epq
SHA256 281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd
MD5 8d0150566ad3db4d9f81702e1f3f8124
SHA1 eb1d0b1eb9d41858896b496ebfcb6bc4a25172b9
SHA512 29a84bc7ab6a65e5ce0662f5bf934372dd420eb4631996e2cc719389945235992db21e5f8249c6872853a1326011d172c2e872f85d42525bc763fa31fd135454
SSDEEP 49152:/6+EXuQSETd1cHIhRCjIqsfspfHQ62DvX+N:/6zXuQSyd0IPCjIPc/QnTu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro 0e6740 evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

risepro

77.91.77.66:58709

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0fc9debbae.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	aea707e9b6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0fc9debbae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	aea707e9b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	aea707e9b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0fc9debbae.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe

Executes dropped EXE 8 IoCs

pid	Process
1660	explortu.exe
2340	explortu.exe
2236	0fc9debbae.exe
2876	aea707e9b6.exe
2564	explortu.exe
3024	explortu.exe
1708	explortu.exe
2164	explortu.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	0fc9debbae.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	aea707e9b6.exe
Key opened	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Wine	explortu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\0fc9debbae.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\0fc9debbae.exe"	explortu.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2876-117-0x00000000008D0000-0x0000000000E00000-memory.dmp	autoit_exe
behavioral2/memory/2876-134-0x00000000008D0000-0x0000000000E00000-memory.dmp	autoit_exe
behavioral2/memory/2876-136-0x00000000008D0000-0x0000000000E00000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

pid	Process
2820	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
1660	explortu.exe
2340	explortu.exe
2236	0fc9debbae.exe
2876	aea707e9b6.exe
2564	explortu.exe
3024	explortu.exe
1708	explortu.exe
2164	explortu.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explortu.job	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133636795252338762"	chrome.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2820	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
2820	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
1660	explortu.exe
1660	explortu.exe
2340	explortu.exe
2340	explortu.exe
2236	0fc9debbae.exe
2236	0fc9debbae.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
1864	chrome.exe
1864	chrome.exe
2564	explortu.exe
2564	explortu.exe
3024	explortu.exe
3024	explortu.exe
1084	chrome.exe
1084	chrome.exe
1708	explortu.exe
1708	explortu.exe
2164	explortu.exe
2164	explortu.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe
Token: SeShutdownPrivilege	1864	chrome.exe
Token: SeCreatePagefilePrivilege	1864	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
2876	aea707e9b6.exe
2876	aea707e9b6.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
1864	chrome.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
2876	aea707e9b6.exe
2876	aea707e9b6.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
1864	chrome.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe
2876	aea707e9b6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1660	2820	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe	74
PID 2820 wrote to memory of 1660	2820	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe	74
PID 2820 wrote to memory of 1660	2820	281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe	74
PID 1660 wrote to memory of 2908	1660	explortu.exe	76
PID 1660 wrote to memory of 2908	1660	explortu.exe	76
PID 1660 wrote to memory of 2908	1660	explortu.exe	76
PID 1660 wrote to memory of 2236	1660	explortu.exe	77
PID 1660 wrote to memory of 2236	1660	explortu.exe	77
PID 1660 wrote to memory of 2236	1660	explortu.exe	77
PID 1660 wrote to memory of 2876	1660	explortu.exe	78
PID 1660 wrote to memory of 2876	1660	explortu.exe	78
PID 1660 wrote to memory of 2876	1660	explortu.exe	78
PID 2876 wrote to memory of 1864	2876	aea707e9b6.exe	79
PID 2876 wrote to memory of 1864	2876	aea707e9b6.exe	79
PID 1864 wrote to memory of 980	1864	chrome.exe	81
PID 1864 wrote to memory of 980	1864	chrome.exe	81
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 4312	1864	chrome.exe	83
PID 1864 wrote to memory of 2708	1864	chrome.exe	84
PID 1864 wrote to memory of 2708	1864	chrome.exe	84
PID 1864 wrote to memory of 2412	1864	chrome.exe	85
PID 1864 wrote to memory of 2412	1864	chrome.exe	85
PID 1864 wrote to memory of 2412	1864	chrome.exe	85
PID 1864 wrote to memory of 2412	1864	chrome.exe	85
PID 1864 wrote to memory of 2412	1864	chrome.exe	85
PID 1864 wrote to memory of 2412	1864	chrome.exe	85
PID 1864 wrote to memory of 2412	1864	chrome.exe	85
PID 1864 wrote to memory of 2412	1864	chrome.exe	85

C:\Users\Admin\AppData\Local\Temp\281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe
"C:\Users\Admin\AppData\Local\Temp\281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
  "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
    "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\1000016001\0fc9debbae.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\0fc9debbae.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2236
- - C:\Users\Admin\AppData\Local\Temp\1000017001\aea707e9b6.exe
    "C:\Users\Admin\AppData\Local\Temp\1000017001\aea707e9b6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd62259758,0x7ffd62259768,0x7ffd62259778
        5⤵
        
        PID:980
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:2
        5⤵
        
        PID:4312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1832 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:8
        5⤵
        
        PID:2708
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:8
        5⤵
        
        PID:2412
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:1
        5⤵
        
        PID:4192
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:1
        5⤵
        
        PID:4268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:1
        5⤵
        
        PID:2348
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:8
        5⤵
        
        PID:4912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:8
        5⤵
        
        PID:4700
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:8
        5⤵
        
        PID:1468
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 --field-trial-handle=1788,i,8775137059214748219,7595041231684708319,131072 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1084

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2340

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4692

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2564

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3024

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1708

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 418c2be113a829419c1f26527bfb32b9e396cde74d9aa8ff6b36cbd9505ad29d
MD5 48300597aa1c59c4460551b23f571a4c
SHA1 f1936dd9cae6728f53d4eeae61dadddd0b6cb82f
SHA512 594e7a2a9ec43a2e53774ed9fe60fa7785cb4b4c085d7b575b984c0cb9a269f6d815adae0d78c36a8ec4a379414218de88c1c472e3d3f28ef13836c1c8c0ab25
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6ca6495dd40729d38116a157482294390bea1b46c8d6b1980a9b6d513246db06
MD5 5fe9cf98b12a1373a9bb1e424d699a03
SHA1 3b14a2ccc2b3930a5175177c4b80c4f472d0d33d
SHA512 662ced9d3aa8fda5ee4b48e5d98e36055d2f657017b7fd4431d7bc0c1d0bfdc621b0a629c306eb6411ceee04ee7cfc31b8071c5e580c2ef59838d5ab8c8a12c4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0a7c0c7f09d4fdeb34cc14b176e2f5a54b933885d0b8d5f5692b61c85955367a
MD5 e661b16266f26eb19b64cb81ea7ac89f
SHA1 f4ccfd7ebe86ab6a08e3529958d502933d642e8c
SHA512 1681fe9f6cbee42af0c756a8273dfb303f0ea1d53c731e7b5f8e1c0a2afbd7957b6f9c6621bce75c6460d8c3de3e26a122f39a7577b9f6b471b2e010822a7f00
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ac4479fad6d1f75d8534c0dab9ffb82cd0c416d95891ef1182edb3a1b3196e51
MD5 bdc081322ddf94e8b229cfbbac290d40
SHA1 2c860158bfc043d087511ad44429164bf3b62827
SHA512 ee0b387ab17e57c2e0773dc716ef7a15215cff1e1fda41f34fbdffdcd79a1983457e77b2409d3b6b30555daffaf2f1429d20ab30d027d3a904bc1a8c8a63e687
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 707B
SHA256 05760cf609ae32a587a896f25d301824d0e587cdf4481aeaf65eb7e2a4ff4ca8
MD5 b9129971ce0d1efef598a6c0b29e0900
SHA1 6d164ea87b50cf30869fee64b0edb19238b50eaf
SHA512 508749d7db1eedb9ae10d10739183043756bbe82d2fb3e19e6c9960b3ee8860ec90f4fb19120ef899e1415f2e0a569b3b338ed1947243560ee744a14ca5c7f00
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 e5c9e77e1d3322afd9b1a5a93737f93470b26554a9f6128caa5b8f5b2b700650
MD5 4e75910d13768b7d73498cabf8b030b1
SHA1 264911161e5b022e91191ff3446c42429dd12f95
SHA512 fb797f6fb295a56411658d92acc8675b64c103697503fb7e16c694f05b1dc843c570cc5ab387ddd713fa3b08d27eb848140dd313a5217c5df2fd8689441e4090
SSDEEP 96:+CplKIM3WP8iZexo2+y7Di+6MsmdeXBktS1uOQp1XLijVhYtjEsXt0/cg2Vup:+0lh8LT+yy+Fgkk4ViotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 5c440dafdda6be4fe79b788c7c7acba04f1d3b7bbcd19131d5df236ae7eb75c5
MD5 f6855d2a9dff28d801159ed8b501f109
SHA1 a0f8838f26f5f07e7132b7081686ad5f2f8e50f9
SHA512 9e725f1013cb91452cbcd28129c504eb984a077e614fbebb2158dbf7eb6707baaba4602b6b02c6ff23cf826e7176873cd35e916166b64afb985f95f3a6e35c04
SSDEEP 96:+CplKIM3WP8iZexo2+y7Di+6MsmdeXBktS1K8OQp1XLijVhYtjEsXt0/cg2Vup:+0lh8LT+yy+Fgkk4YViotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 3e7cbe3e2ab382027fed3ddf8e53ed394fdc4a77a9bae6b97142455d1e41b2ee
MD5 fb84443dfbebb1b328239c6f78c746fc
SHA1 3317d19e8d5f1456d042ae83339dae98bcbb9c31
SHA512 645f460151af6c72aea74bc124da3c002830af5bd77cbeb1897e4fee685bbf32bfe053fec1735d5bb41dbf9c4cbfdcfa15aac130e0fb50f91bb05c230872f8bd
SSDEEP 96:+CplKIM3WP8iZexo2+y7Di+6MsmdeXBktS1WOQp1XLijVhYtjEsXt0/cg2Vup:+0lh8LT+yy+Fgkk0ViotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 12KB
SHA256 7ee5ae8ec5419a4eadf7b4538607e7c60319273c284c89ac207f6ad2463a70da
MD5 cf50e4585541af2fa4600734a1338bd4
SHA1 b63d22296cb33383d07c3a49332d7c5410a24ffe
SHA512 4fcad69d647ed2d47782eeb31f5eee0c18a67f11a76e2bc7bd4a12693e8e72936b822a6f0c06e64a24b94fa398f9d45028bf56adc28507c81db3d07b319094a5
SSDEEP 384:slXC1kXqKf/pUZNCgVLH2Hfk5rUmHG6JcxGnD:YC1kXqKf/pUZNCgVLH2HfirUGGYD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 287KB
SHA256 7aa9a430a23883f4e66aafb3fcc6b195ae751711cce0ba468be6462a4c5a204c
MD5 74cba2f7671d3dd39d121cda1c5cf1b2
SHA1 4d8bf3fe4400ecf4128410f8faac7c8128f826ad
SHA512 7cb423dc454de077f02313f3c0404a80eeb791140d44803710bfa767a6fe3e2c00cfd53edee7aeed58d8b7cc404ac8f038e42d50fdc2c4fe64f842cd7b973d7a
SSDEEP 6144:Lwa6N8uf/g1u/MLgDor5vt8WJ4/UKSe33uWhSmpGeLOpH576KQ6L9E:LMNs1hgoVvU/xSenbh/kpR6KnL+
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0fc9debbae.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\0fc9debbae.exe
Size 2.3MB
SHA256 041c058f3cbacbf7627fed950268e8720b5e7e44ce1558bac2c2d6e0a117af9c
MD5 7cfeaeccbe1e171218a5b4ea49bff0d6
SHA1 5f357caf7bffba938a455639915269b2ac05e395
SHA512 eb3366bd543d956e6d71dc3f4590b017fbc7d5cb8a99973edbc3c4ecf0ada0ea3f26fb03a612c0e0a333468e5e504f9ba6063f849635d632040c04a975033ec7
SSDEEP 49152:WnnLDtsKQ+gYzlikMrQSZuWmERckbFGYn657slrfIYL62YZeyA:ExnQ+fpM/ZuE3bfnc4ZfIE62Wey
MD5 SHA1 SHA512 SSDEEP

Submit Download

aea707e9b6.exe

Path C:\Users\Admin\AppData\Local\Temp\1000017001\aea707e9b6.exe
Size 2.2MB
SHA256 238a720bf3008aeee09aa5297a8fd9ee71cd055467dca36f6bc41cb204282e15
MD5 e844c4e82035bdbf7775d8abdf115cf8
SHA1 455c505e32b8760a26ef52deaf747aef6d3816a9
SHA512 441407d304fe29198e0cb6f411c732dee890f56bf051483797f40339f7d3f7b12b8d753667e89c01e3de890005a270c3b72ca3721362e0b2bd9e0b8fc241f889
SSDEEP 49152:mzONxC6wyZbt4D3u6O4W3cKQbEWhhxs511MOEmPWXvyOw:iONoyNeju6O4sF+hxsSFWyvnw
MD5 SHA1 SHA512 SSDEEP

Submit Download

explortu.exe

Path C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
Size 1.8MB
SHA256 281eca69a81120aee1b1afc92420c4a2d5931944aed7c362ff639075be739ecd
MD5 8d0150566ad3db4d9f81702e1f3f8124
SHA1 eb1d0b1eb9d41858896b496ebfcb6bc4a25172b9
SHA512 29a84bc7ab6a65e5ce0662f5bf934372dd420eb4631996e2cc719389945235992db21e5f8249c6872853a1326011d172c2e872f85d42525bc763fa31fd135454
SSDEEP 49152:/6+EXuQSETd1cHIhRCjIqsfspfHQ62DvX+N:/6zXuQSyd0IPCjIPc/QnTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1660-211-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-223-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-27-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-29-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-30-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-26-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-215-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-44-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-213-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-46-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-160-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-25-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-209-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-24-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-85-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-218-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-198-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-193-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-20-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-28-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-18-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-187-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-16-0x00000000013D1000-0x00000000013FF000-memory.dmp

Download

memory/1660-123-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-185-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-15-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-183-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-135-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-181-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-225-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-179-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-143-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-227-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-238-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-154-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-240-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1660-156-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1708-196-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/1708-194-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/2164-221-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/2164-219-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/2236-184-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-222-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-144-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-142-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-180-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-241-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-182-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-239-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-157-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-124-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-186-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-228-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-188-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-94-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-164-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-226-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-197-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-210-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-224-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-208-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-155-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-47-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-216-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-212-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-45-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-214-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2236-43-0x00000000003B0000-0x00000000009A2000-memory.dmp

Download

memory/2340-19-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/2340-21-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/2564-93-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/2564-92-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/2820-2-0x0000000000E11000-0x0000000000E3F000-memory.dmp

Download

memory/2820-0-0x0000000000E10000-0x00000000012C6000-memory.dmp

Download

memory/2820-14-0x0000000000E10000-0x00000000012C6000-memory.dmp

Download

memory/2820-3-0x0000000000E10000-0x00000000012C6000-memory.dmp

Download

memory/2820-5-0x0000000000E10000-0x00000000012C6000-memory.dmp

Download

memory/2820-1-0x0000000077C14000-0x0000000077C15000-memory.dmp

Download

memory/2876-59-0x00000000008D0000-0x0000000000E00000-memory.dmp

Download

memory/2876-117-0x00000000008D0000-0x0000000000E00000-memory.dmp

Download

memory/2876-134-0x00000000008D0000-0x0000000000E00000-memory.dmp

Download

memory/2876-136-0x00000000008D0000-0x0000000000E00000-memory.dmp

Download

memory/3024-161-0x00000000013D0000-0x0000000001886000-memory.dmp

Download

memory/3024-163-0x00000000013D0000-0x0000000001886000-memory.dmp

Download